theory Syscall_C

lemma decodeInvocation_ccorres:
  "interpret_excaps extraCaps' = excaps_map extraCaps
  \<Longrightarrow>
   ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple
              and valid_cap' cp and (\<lambda>s. \<forall>x \<in> zobj_refs' cp. ex_nonz_cap_to' x s)
              and (excaps_in_mem extraCaps \<circ> ctes_of)
              and cte_wp_at' ((=) cp \<circ> cteCap) slot
              and (\<lambda>s. \<forall>v \<in> set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)
              and (\<lambda>s. \<forall>v \<in> set extraCaps. s \<turnstile>' fst v \<and> cte_at' (snd v) s)
              and (\<lambda>s. \<forall>v \<in> set extraCaps. \<forall>y \<in> zobj_refs' (fst v). ex_nonz_cap_to' y s)
              and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))
              and sysargs_rel args buffer)
       (UNIV \<inter> {s. call_' s = from_bool isCall}
             \<inter> {s. block_' s = from_bool isBlocking}
             \<inter> {s. call_' s = from_bool isCall}
             \<inter> {s. block_' s = from_bool isBlocking}
             \<inter> {s. invLabel_' s = label}
             \<inter> {s. unat (length___unsigned_long_' s) = length args}
             \<inter> {s. capIndex_' s = cptr}
             \<inter> {s. slot_' s = cte_Ptr slot}
             \<inter> {s. current_extra_caps_' (globals s) = extraCaps'}
             \<inter> {s. ccap_relation cp (cap_' s)}
             \<inter> {s. buffer_' s = option_to_ptr buffer}) []
       (decodeInvocation label args cptr slot cp extraCaps
              >>= invocationCatch thread isBlocking isCall id)
       (Call decodeInvocation_'proc)" apply (cinit' lift: call_' block_' invLabel_' length___unsigned_long_'
                      capIndex_' slot_' current_extra_caps_' cap_' buffer_') apply csymbr apply (simp add: cap_get_tag_isCap decodeInvocation_def
              cong: if_cong StateSpace.state.fold_congs
                    globals.fold_congs
               del: Collect_const) apply (cut_tac cap=cp in cap_cases_one_on_true_sum) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: Let_def isArchCap_T_isArchObjectCap
                     liftME_invocationCatch from_bool_neq_0) apply (rule ccorres_split_throws) apply (rule ccorres_trim_returnE) apply simp apply simp apply (rule ccorres_call, rule Arch_decodeInvocation_ccorres [where buffer=buffer]) apply assumption apply simp+ apply (vcg exspec=Arch_decodeInvocation_modifies) apply simp apply csymbr apply (simp add: cap_get_tag_isCap del: Collect_const) apply (rule ccorres_Cond_rhs) apply (simp add: invocationCatch_def throwError_bind) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (rule ccorres_Cond_rhs) apply (simp add: invocationCatch_def throwError_bind) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (rule ccorres_Cond_rhs) apply (simp add: if_to_top_of_bind) apply (rule ccorres_rhs_assoc)+ apply csymbr apply (rule ccorres_if_cond_throws2[where Q=\<top> and Q'=\<top>]) apply (clarsimp simp: isCap_simps Collect_const_mem) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (drule(1) cap_get_tag_to_H) apply (clarsimp simp: to_bool_def) apply (simp add: throwError_bind invocationCatch_def) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: returnOk_bind ccorres_invocationCatch_Inr
                      performInvocation_def bind_assoc liftE_bindE) apply (ctac add: setThreadState_ccorres) apply csymbr apply csymbr apply csymbr apply csymbr apply (rule ccorres_pre_getCurThread) apply (simp only: liftE_bindE[symmetric]) apply (ctac add: performInvocation_Endpoint_ccorres) apply (rule ccorres_alternative2) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply simp apply (vcg exspec=performInvocation_Endpoint_modifies) apply simp apply (rule hoare_use_eq[where f=ksCurThread]) apply (wp sts_invs_minor' sts_st_tcb_at'_cases
                 setThreadState_ct' hoare_vcg_all_lift sts_ksQ')+ apply simp apply (vcg exspec=setThreadState_modifies) apply vcg apply (rule ccorres_Cond_rhs) apply (rule ccorres_rhs_assoc)+ apply (csymbr) apply (simp add: if_to_top_of_bind Collect_const[symmetric]
                del: Collect_const) apply (rule ccorres_if_cond_throws2[where Q=\<top> and Q'=\<top>]) apply (clarsimp simp:  isCap_simps Collect_const_mem) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (drule(1) cap_get_tag_to_H) apply (clarsimp simp: to_bool_def) apply (simp add: throwError_bind invocationCatch_def) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: returnOk_bind ccorres_invocationCatch_Inr
                      performInvocation_def bindE_assoc) apply (simp add: liftE_bindE) apply (ctac add: setThreadState_ccorres) apply csymbr apply csymbr apply (simp only: liftE_bindE[symmetric]) apply (ctac(no_vcg) add: performInvocation_Notification_ccorres) apply (rule ccorres_alternative2) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (wp sts_invs_minor') apply simp apply (vcg exspec=setThreadState_modifies) apply vcg apply (rule ccorres_Cond_rhs) apply (simp add: if_to_top_of_bind) apply (rule ccorres_rhs_assoc)+ apply csymbr apply (rule ccorres_if_cond_throws2[where Q=\<top> and Q'=\<top>]) apply (clarsimp simp: isCap_simps Collect_const_mem) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (clarsimp simp: cap_get_tag_ReplyCap to_bool_def) apply (simp add: throwError_bind invocationCatch_def) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: returnOk_bind ccorres_invocationCatch_Inr
                      performInvocation_def liftE_bindE
                      bind_assoc) apply (ctac add: setThreadState_ccorres) apply csymbr apply csymbr apply (rule ccorres_pre_getCurThread) apply (simp only: liftE_bindE[symmetric]) apply (ctac add: performInvocation_Reply_ccorres) apply (rule ccorres_alternative2) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply simp apply (vcg exspec=performInvocation_Reply_modifies) apply (simp add: cur_tcb'_def[symmetric]) apply (rule_tac R="\<lambda>rv s. ksCurThread s = thread" in hoare_post_add) apply (simp cong: conj_cong) apply (strengthen imp_consequent) apply (wp sts_invs_minor' sts_st_tcb_at'_cases) apply simp apply (vcg exspec=setThreadState_modifies) apply vcg apply (rule ccorres_Cond_rhs) apply (simp add: if_to_top_of_bind) apply (rule ccorres_trim_returnE, simp+) apply (simp add: liftME_invocationCatch) apply (rule ccorres_call, rule decodeTCBInvocation_ccorres) apply assumption apply (simp+)[3] apply (rule ccorres_Cond_rhs) apply (rule ccorres_trim_returnE, simp+) apply (simp add: liftME_invocationCatch) apply (rule ccorres_call,
           erule decodeDomainInvocation_ccorres,
           simp+)[1] apply (rule ccorres_Cond_rhs) apply (simp add: if_to_top_of_bind) apply (rule ccorres_trim_returnE, simp+) apply (simp add: liftME_invocationCatch) apply (rule ccorres_call,
           erule decodeCNodeInvocation_ccorres,
           simp+)[1] apply (rule ccorres_Cond_rhs) apply simp apply (rule ccorres_trim_returnE, simp+) apply (simp add: liftME_invocationCatch) apply (rule ccorres_call,
           erule decodeUntypedInvocation_ccorres, simp+)[1] apply (rule ccorres_Cond_rhs) apply (simp add: liftME_invocationCatch) apply (rule ccorres_trim_returnE, simp+) apply (rule ccorres_call, erule decodeIRQControlInvocation_ccorres,
           simp+)[1] apply (rule ccorres_Cond_rhs) apply (simp add: Let_def liftME_invocationCatch) apply (rule ccorres_rhs_assoc)+ apply csymbr apply (rule ccorres_trim_returnE, simp+) apply (rule ccorres_call,
           erule decodeIRQHandlerInvocation_ccorres, simp+) apply (rule ccorres_inst[where P=\<top> and P'=UNIV]) apply (simp add: isArchCap_T_isArchObjectCap one_on_true_def from_bool_0) apply (rule conjI) apply (clarsimp simp: tcb_at_invs' ct_in_state'_def
                         simple_sane_strg) apply (clarsimp simp: cte_wp_at_ctes_of valid_cap'_def isCap_simps
                         unat_eq_0 sysargs_rel_n_def n_msgRegisters_def valid_tcb_state'_def
             | rule conjI | erule pred_tcb'_weakenE disjE
             | drule st_tcb_at_idle_thread')+ apply fastforce apply (simp add: cap_lift_capEPBadge_mask_eq) apply (clarsimp simp: rf_sr_ksCurThread Collect_const_mem
                        cap_get_tag_isCap "StrictC'_thread_state_defs") apply (frule word_unat.Rep_inverse') apply (simp add: cap_get_tag_isCap[symmetric] cap_get_tag_ReplyCap) apply (rule conjI) apply (simp add: cap_get_tag_isCap) apply (clarsimp simp: isCap_simps cap_get_tag_to_H from_bool_neq_0) apply (insert ccap_relation_IRQHandler_mask, elim meta_allE, drule(1) meta_mp) apply (clarsimp simp: word_size) apply (clarsimp simp: less_mask_eq) apply (clarsimp simp: cap_get_tag_isCap) apply (cases cp ; clarsimp simp: isCap_simps) apply (frule cap_get_tag_isCap_unfolded_H_cap, drule (1) cap_get_tag_to_H) apply fastforce apply (frule cap_get_tag_isCap_unfolded_H_cap, drule (1) cap_get_tag_to_H) apply (fastforce simp: cap_endpoint_cap_lift_def mask_eq_ucast_eq) apply (frule ccap_relation_ep_helpers) apply (clarsimp simp: cap_get_tag_isCap isEndpointCap_def) apply clarsimp apply (rule cap_lift_capEPBadge_mask_eq[OF cap_endpoint_cap_lift[THEN iffD1]]) apply (clarsimp simp:  cap_get_tag_isCap isEndpointCap_def) apply (frule ccap_relation_reply_helpers) apply (clarsimp simp:  cap_get_tag_isCap isReplyCap_def) apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and sysargs_rel args buffer) (UNIV \<inter> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>invLabel = label\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>capIndex = cptr\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = extraCaps'\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (global.decodeInvocation label args cptr slot cp extraCaps >>= invocationCatch thread isBlocking isCall id) (Call decodeInvocation_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q12985 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) (?Q'12985 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) [SKIP] (global.decodeInvocation label args cptr slot cp extraCaps >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned_long :== CALL isArchCap_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(invLabel,length___unsigned_long,capIndex,slota,cap,calla,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_4,block,calla);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(invLabel,length___unsigned_long,cap,slota,calla,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(invLabel,length___unsigned_long,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(invLabel,length___unsigned_long,cap,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(invLabel,length___unsigned_long,slota,cap,calla,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(invLabel,length___unsigned_long,slota,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(invLabel,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q12985 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s \<and> s' \<in> ?Q'12985 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag cap))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q12985 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) (?G'12994 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long) [SKIP] (global.decodeInvocation label args cptr slot cp extraCaps >>= invocationCatch thread isBlocking isCall id) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(invLabel,length___unsigned_long,capIndex,slota,cap,calla,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_4,block,calla);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(invLabel,length___unsigned_long,cap,slota,calla,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(invLabel,length___unsigned_long,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(invLabel,length___unsigned_long,cap,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(invLabel,length___unsigned_long,slota,cap,calla,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(invLabel,length___unsigned_long,slota,buffera);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(invLabel,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q12985 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'12994 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v} proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cp)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q12985 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?G'12994 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (from_bool (isArchCap (\<lambda>_. True) cp))) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isArchCap (\<lambda>_. True) cp THEN
  \<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(label,length___unsigned_long,cptr,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q12985 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'12994 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v} proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cp); one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (isNullCap cp) + one_on_true (isDomainCap cp) = 1\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q12985 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?G'12994 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (from_bool (isArchCap (\<lambda>_. True) cp))) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isArchCap (\<lambda>_. True) cp THEN
  \<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(label,length___unsigned_long,cptr,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q12985 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'12994 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cp); one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (isNullCap cp) + one_on_true (isDomainCap cp) = 1; isArchCap (\<lambda>_. True) cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q14181 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S14184 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (from_bool (isArchCap (\<lambda>_. True) cp))) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(label,length___unsigned_long,cptr,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cp); one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (isNullCap cp) + one_on_true (isDomainCap cp) = 1; \<not> isArchCap (\<lambda>_. True) cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14180 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T14182 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (from_bool (isArchCap (\<lambda>_. True) cp))) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> ?Q14181 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> ?R14180 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?S14184 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?T14182 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v)}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q14181 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S14184 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeArchObject) (\<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(label,length___unsigned_long,cptr,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cp); one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (isNullCap cp) + one_on_true (isDomainCap cp) = 1; \<not> isArchCap (\<lambda>_. True) cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14180 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T14182 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (from_bool (isArchCap (\<lambda>_. True) cp))) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> ?Q14181 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> ?R14180 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?S14184 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?T14182 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v)}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q14181 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?P'14201 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeArchObject) (\<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(label,length___unsigned_long,cptr,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14200 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(label,length___unsigned_long,cptr,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_' {},UNIV
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cp); one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (isNullCap cp) + one_on_true (isDomainCap cp) = 1; \<not> isArchCap (\<lambda>_. True) cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14180 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T14182 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (from_bool (isArchCap (\<lambda>_. True) cp))) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI))
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> ?Q14181 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> ?R14180 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?P'14201 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v \<inter> ?R'14200 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?T14182 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v)}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> s\<lparr>ret__unsigned_long_' := ret__unsigned_long_' s\<rparr> = s
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long f s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> ret__unsigned_long_' (global_exn_var_'_update f s) = ret__unsigned_long_' s
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q14181 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?P'14201 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeArchObject) (\<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(label,length___unsigned_long,cptr,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer))
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14200 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(label,length___unsigned_long,cptr,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_' {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cp); one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (isNullCap cp) + one_on_true (isDomainCap cp) = 1; \<not> isArchCap (\<lambda>_. True) cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14180 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T14182 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (from_bool (isArchCap (\<lambda>_. True) cp))) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI))
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> ?Q14181 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> ?R14180 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?P'14201 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v \<inter> ?R'14200 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?T14182 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v)}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long f s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> ret__unsigned_long_' (global_exn_var_'_update f s) = ret__unsigned_long_' s
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q14181 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?P'14201 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeArchObject) (\<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(label,length___unsigned_long,cptr,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14200 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(label,length___unsigned_long,cptr,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_' {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cp); one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (isNullCap cp) + one_on_true (isDomainCap cp) = 1; \<not> isArchCap (\<lambda>_. True) cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14180 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T14182 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (from_bool (isArchCap (\<lambda>_. True) cp))) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI))
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> ?Q14181 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> ?R14180 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?P'14201 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v \<inter> ?R'14200 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?T14182 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v)}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q14181 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?P'14201 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeArchObject) (\<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(label,length___unsigned_long,cptr,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14200 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(label,length___unsigned_long,cptr,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_' {},UNIV
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cp); one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (isNullCap cp) + one_on_true (isDomainCap cp) = 1; \<not> isArchCap (\<lambda>_. True) cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14180 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T14182 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (from_bool (isArchCap (\<lambda>_. True) cp))) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI))
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> ?Q14181 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> ?R14180 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?P'14201 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v \<inter> ?R'14200 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?T14182 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v)}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> interpret_excaps (?extraCaps'14225 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) true)) = excaps_map extraCaps
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long s ta sa. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> globals (sa\<lparr>ret__unsigned_long_' := ret__unsigned_long_' ta\<rparr>) = globals sa
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long a s t. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>) = liftxf errstate id (K ()) ret__unsigned_long_' t
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> globals (buffer_'_update (\<lambda>_. option_to_ptr buffer) (call_'_update (\<lambda>_. from_bool isCall) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. cte_Ptr slot) (cptr_'_update (\<lambda>_. cptr) (s\<lparr>invLabel_' := label, length___unsigned_long_' := length___unsigned_long\<rparr>)))))) = globals s
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14200 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(label,length___unsigned_long,cptr,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_' {},UNIV
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cp); one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (isNullCap cp) + one_on_true (isDomainCap cp) = 1; \<not> isArchCap (\<lambda>_. True) cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14180 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T14182 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (from_bool (isArchCap (\<lambda>_. True) cp))) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI))
 7. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> ?R14180 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = ?extraCaps'14225 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> ?R'14200 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?T14182 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v)}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long s ta sa. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> globals (sa\<lparr>ret__unsigned_long_' := ret__unsigned_long_' ta\<rparr>) = globals sa
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long a s t. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>) = liftxf errstate id (K ()) ret__unsigned_long_' t
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> globals (buffer_'_update (\<lambda>_. option_to_ptr buffer) (call_'_update (\<lambda>_. from_bool isCall) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. cte_Ptr slot) (cptr_'_update (\<lambda>_. cptr) (s\<lparr>invLabel_' := label, length___unsigned_long_' := length___unsigned_long\<rparr>)))))) = globals s
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14200 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(label,length___unsigned_long,cptr,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_' {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cp); one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (isNullCap cp) + one_on_true (isDomainCap cp) = 1; \<not> isArchCap (\<lambda>_. True) cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14180 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T14182 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (from_bool (isArchCap (\<lambda>_. True) cp))) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI))
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> ?R14180 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> ?R'14200 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?T14182 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v)}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; \<not> isZombie cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.NullCap \<and> cp \<noteq> capability.DomainCap; isArchObjectCap cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14200 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) true)) \<acute>ret__unsigned_long :== CALL Arch_decodeInvocation_'proc(label,length___unsigned_long,cptr,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_' {},UNIV
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cp); one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (isNullCap cp) + one_on_true (isDomainCap cp) = 1; \<not> isArchCap (\<lambda>_. True) cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14180 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T14182 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (from_bool (isArchCap (\<lambda>_. True) cp))) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> ?R14180 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> ?R'14200 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?T14182 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v)}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cp); one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (isNullCap cp) + one_on_true (isDomainCap cp) = 1; \<not> isArchCap (\<lambda>_. True) cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14180 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T14182 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (from_bool (isArchCap (\<lambda>_. True) cp))) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> ?R14180 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?T14182 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v)}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14180 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T14182 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> ?R14180 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> ?T14182 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v)}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14180 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?G'14311 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) ret__unsigned) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> ?R14180 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'14311 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va})}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14180 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?G'14311 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF cp = capability.NullCap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF isZombie cp THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF isEndpointCap cp THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> ?R14180 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'14311 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q15204 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S15207 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15203 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15205 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isZombie cp THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF isEndpointCap cp THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> ?Q15204 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> ?R15203 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> ?S15207 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> ?T15205 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation capability.NullCap cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isZombie capability.NullCap \<and> \<not> isArchObjectCap capability.NullCap \<and> \<not> isThreadCap capability.NullCap \<and> \<not> isNotificationCap capability.NullCap \<and> \<not> isEndpointCap capability.NullCap \<and> \<not> isReplyCap capability.NullCap \<and> \<not> isIRQControlCap capability.NullCap \<and> \<not> isIRQHandlerCap capability.NullCap; ret__unsigned = cap_get_tag cap; cp = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q15204 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S15207 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (throwError (Inl (Fault_H.syscall_error.InvalidCapability 0))) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15203 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15205 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isZombie cp THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF isEndpointCap cp THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> ?Q15204 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> ?R15203 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> ?S15207 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> ?T15205 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation capability.NullCap cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isZombie capability.NullCap \<and> \<not> isArchObjectCap capability.NullCap \<and> \<not> isThreadCap capability.NullCap \<and> \<not> isNotificationCap capability.NullCap \<and> \<not> isEndpointCap capability.NullCap \<and> \<not> isReplyCap capability.NullCap \<and> \<not> isIRQControlCap capability.NullCap \<and> \<not> isIRQHandlerCap capability.NullCap; ret__unsigned = cap_get_tag cap; cp = capability.NullCap\<rbrakk> \<Longrightarrow> syscall_error_to_H (invalidCapNumber_C_update (\<lambda>_. 0) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) err')) ft' = Some (Fault_H.syscall_error.InvalidCapability 0)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15203 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15205 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isZombie cp THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF isEndpointCap cp THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> ?R15203 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> ?T15205 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)}})}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15203 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15205 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isZombie cp THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
ELSE
  IF isEndpointCap cp THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> ?R15203 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> ?T15205 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; isZombie cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q15233 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S15236 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15232 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15234 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isEndpointCap cp THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> ?Q15233 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isZombie cp \<longrightarrow> ?R15232 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> ?S15236 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> ?T15234 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; isZombie cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q15233 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S15236 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (throwError (Inl (Fault_H.syscall_error.InvalidCapability 0))) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15232 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15234 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isEndpointCap cp THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> ?Q15233 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isZombie cp \<longrightarrow> ?R15232 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> ?S15236 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> ?T15234 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isEndpointCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; isZombie cp\<rbrakk> \<Longrightarrow> syscall_error_to_H (invalidCapNumber_C_update (\<lambda>_. 0) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) err')) ft' = Some (Fault_H.syscall_error.InvalidCapability 0)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15232 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15234 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isEndpointCap cp THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> ?R15232 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> ?T15234 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15232 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15234 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isEndpointCap cp THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> ?R15232 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> ?T15234 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q15257 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S15260 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ?Q15257 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> ?S15260 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q15257 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S15260 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (if capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) >>= invocationCatch thread isBlocking isCall id else (if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ?Q15257 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> ?S15260 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q15257 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S15260 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (if capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) >>= invocationCatch thread isBlocking isCall id else (if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
(\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ?Q15257 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> ?S15260 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q15257 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?G'15306 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (if capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) >>= invocationCatch thread isBlocking isCall id else (if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
(\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ?Q15257 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'15306 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (\<not> capEPCanSend cp) = (s' \<in> \<lbrace>ret__unsigned = 0\<rbrace>)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); \<not> capEPCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15503 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'15499 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] ((if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U15501 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'15495 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
(\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> ?R15503 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ?U15501 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?R'15499 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'15495 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>cap length___unsigned_long v0 v1 v2 v3 v4 v5 s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; ccap_relation (capability.EndpointCap v0 v1 v2 v3 v4 v5) cap; unat length___unsigned_long = length args; cp = capability.EndpointCap v0 v1 v2 v3 v4 v5; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<not> v2) = (capCanSend_CL (cap_endpoint_cap_lift cap) = 0)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); \<not> capEPCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15503 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'15499 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] ((if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U15501 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'15495 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
(\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> ?R15503 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ?U15501 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?R'15499 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'15495 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>cap length___unsigned_long v0 v1 v2 v3 v4 v5 s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; ccap_relation (capability.EndpointCap v0 v1 v2 v3 v4 v5) cap; unat length___unsigned_long = length args; cp = capability.EndpointCap v0 v1 v2 v3 v4 v5; (s, s') \<in> rf_sr; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrakk> \<Longrightarrow> (\<not> v2) = (capCanSend_CL (cap_endpoint_cap_lift cap) = 0)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); \<not> capEPCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15503 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'15499 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] ((if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U15501 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'15495 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
(\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> ?R15503 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ?U15501 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?R'15499 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'15495 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>cap length___unsigned_long v0 v1 v2 v3 v4 v5 s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; cp = capability.EndpointCap v0 v1 v2 v3 v4 v5; (s, s') \<in> rf_sr; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capability.EndpointCap v0 v1 v2 v3 v4 v5 = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap)) (capEPBadge_CL (cap_endpoint_cap_lift cap)) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap)))\<rbrakk> \<Longrightarrow> (\<not> v2) = (capCanSend_CL (cap_endpoint_cap_lift cap) = 0)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); \<not> capEPCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15503 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'15499 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] ((if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U15501 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'15495 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
(\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> ?R15503 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ?U15501 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?R'15499 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'15495 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); \<not> capEPCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15503 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'15499 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] ((if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U15501 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'15495 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
(\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> ?R15503 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ?U15501 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?R'15499 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'15495 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); \<not> capEPCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15503 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'15499 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) [SKIP] (throwError (Inl (Fault_H.syscall_error.InvalidCapability 0))) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U15501 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'15495 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
(\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> ?R15503 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ?U15501 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?R'15499 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'15495 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); \<not> capEPCanSend cp\<rbrakk> \<Longrightarrow> syscall_error_to_H (invalidCapNumber_C_update (\<lambda>_. 0) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) err')) ft' = Some (Fault_H.syscall_error.InvalidCapability 0)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U15501 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'15495 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
(\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ?U15501 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'15495 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U15501 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'15495 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
(\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ?U15501 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'15495 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U15501 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'15495 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
threada <- getCurThread;
y <- sendIPC isBlocking isCall (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp) threada (capEPPtr cp);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
(\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ?U15501 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'15495 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q15551 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv) (?Q'15551 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv xfdc) [SKIP] (do threada <- getCurThread;
y <- sendIPC isBlocking isCall (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp) threada (capEPPtr cp);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
(\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R15559 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q15551 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'15551 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s)}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R15559 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q15551 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv) (?G'15609 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned) [SKIP] (do threada <- getCurThread;
y <- sendIPC isBlocking isCall (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp) threada (capEPPtr cp);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
(\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R15559 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q15551 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'15609 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R15559 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q15551 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv) (?G'15776 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2) [SKIP] (do threada <- getCurThread;
y <- sendIPC isBlocking isCall (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp) threada (capEPPtr cp);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(cap);;
(\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr ret__unsigned,unsigned_eret_2,\<acute>unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R15559 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q15551 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> ?G'15776 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R15559 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q15551 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv) (?G'15908 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3) [SKIP] (do threada <- getCurThread;
y <- sendIPC isBlocking isCall (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp) threada (capEPPtr cp);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (\<acute>unsigned_eret_4 :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr ret__unsigned,unsigned_eret_2,unsigned_eret_3,\<acute>unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R15559 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q15551 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vb v'. vb = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. sa \<in> ?G'15908 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R15559 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q15551 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv) (?G'16015 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4) [SKIP] (do threada <- getCurThread;
y <- sendIPC isBlocking isCall (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp) threada (capEPPtr cp);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr ret__unsigned,unsigned_eret_2,unsigned_eret_3,unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R15559 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q15551 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vb v'. vb = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vc v'. vc = capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_4_' := vc\<rparr> \<in> {sa. sa \<in> ?G'16015 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R15559 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 threada. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P16095 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv threada) (?P'16094 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 threada) [SKIP] (do y <- sendIPC isBlocking isCall (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp) threada (capEPPtr cp);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr ret__unsigned,unsigned_eret_2,unsigned_eret_3,unsigned_eret_4,from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R15559 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> ?P16095 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned a rv b\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vb v'. vb = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vc v'. vc = capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_4_' := vc\<rparr> \<in> {sa. sa \<in> {sa. \<forall>rva. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rva \<longrightarrow> sa \<in> ?P'16094 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va vb vc rva}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R15559 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 threada. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P16095 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap)) rv threada) (?P'16094 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap)) rv xfdc (capEPPtr_CL (cap_endpoint_cap_lift cap)) (capEPBadge_CL (cap_endpoint_cap_lift cap)) (capCanGrant_CL (cap_endpoint_cap_lift cap)) (capCanGrantReply_CL (cap_endpoint_cap_lift cap)) threada) [SKIP] (doE y <- liftE (sendIPC isBlocking isCall (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp) threada (capEPPtr cp));
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
odE) (\<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap)),capEPBadge_CL (cap_endpoint_cap_lift cap),capCanGrant_CL (cap_endpoint_cap_lift cap),capCanGrantReply_CL (cap_endpoint_cap_lift cap),from_bool isBlocking,from_bool isCall);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R15559 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> ?P16095 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned a rv b\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vb v'. vb = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vc v'. vc = capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_4_' := vc\<rparr> \<in> {sa. sa \<in> {sa. \<forall>rva. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rva \<longrightarrow> sa \<in> ?P'16094 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va vb vc rva}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R15559 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 threada rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap); dc rva (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 threada rva) (?Q'16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 threada rva ret__unsigned_long) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned_long))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread err) (?Q''16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R16109 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap)) rv thread\<rbrace> liftE (sendIPC isBlocking isCall (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp) thread (capEPPtr cp)) \<lbrace>?Q16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread\<rbrace>, \<lbrace>?QE16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread\<rbrace>
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16102 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap)) rv xfdc (capEPPtr_CL (cap_endpoint_cap_lift cap)) (capEPBadge_CL (cap_endpoint_cap_lift cap)) (capCanGrant_CL (cap_endpoint_cap_lift cap)) (capCanGrantReply_CL (cap_endpoint_cap_lift cap)) thread) \<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap)),capEPBadge_CL (cap_endpoint_cap_lift cap),capCanGrant_CL (cap_endpoint_cap_lift cap),capCanGrantReply_CL (cap_endpoint_cap_lift cap),from_bool isBlocking,from_bool isCall) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. dc rva (K () (ret__unsigned_long_' s)) \<longrightarrow> s \<in> ?Q'16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread rva (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R15559 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and ep_at' (capEPPtr cp) and sch_act_sane and (\<lambda>s. rv = ksCurThread s \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) and ?R16109 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned a rv) b\<rbrace>
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vb v'. vb = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vc v'. vc = capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_4_' := vc\<rparr> \<in> {sa. sa \<in> {sa. \<forall>rva. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rva \<longrightarrow> sa \<in> {s. call_'_update (\<lambda>_. calla) (block_'_update (\<lambda>_. block) (canGrantReply_'_update (\<lambda>_. vc) (canGrant_'_update (\<lambda>_. vb) (badge_'_update (\<lambda>_. va) (ep_'_update (\<lambda>_. ep_Ptr v) s))))) \<in> UNIV \<inter> \<lbrace>\<acute>block = block\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge cp\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cp)\<rbrace> \<inter> \<lbrace>\<acute>canGrantReply = from_bool (capEPCanGrantReply cp)\<rbrace> \<inter> \<lbrace>\<acute>ep = ep_Ptr (capEPPtr cp)\<rbrace> \<inter> \<lbrace>capEPBadge cp && mask 28 = capEPBadge cp\<rbrace>} \<inter> ?R'16102 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va vb vc rva}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}
 7. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 8. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 9. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R15559 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (9 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap); dc rva (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread rva) (?Q'16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread rva ret__unsigned_long) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned_long))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread err) (?Q''16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R16109 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap)) rv thread\<rbrace> liftE (sendIPC isBlocking isCall (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp) thread (capEPPtr cp)) \<lbrace>?Q16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread\<rbrace>, \<lbrace>?QE16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread\<rbrace>
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16102 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap)) rv xfdc (capEPPtr_CL (cap_endpoint_cap_lift cap)) (capEPBadge_CL (cap_endpoint_cap_lift cap)) (capCanGrant_CL (cap_endpoint_cap_lift cap)) (capCanGrantReply_CL (cap_endpoint_cap_lift cap)) thread) \<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap)),capEPBadge_CL (cap_endpoint_cap_lift cap),capCanGrant_CL (cap_endpoint_cap_lift cap),capCanGrantReply_CL (cap_endpoint_cap_lift cap),from_bool isBlocking,from_bool isCall) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. dc rva (K () (ret__unsigned_long_' s)) \<longrightarrow> s \<in> ?Q'16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread rva (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R15559 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and ep_at' (capEPPtr cp) and sch_act_sane and (\<lambda>s. rv = ksCurThread s \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) and ?R16109 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned a rv) b\<rbrace>
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vb v'. vb = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vc v'. vc = capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_4_' := vc\<rparr> \<in> {sa. sa \<in> {sa. \<forall>rva. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rva \<longrightarrow> sa \<in> {s. call_'_update (\<lambda>_. calla) (block_'_update (\<lambda>_. block) (canGrantReply_'_update (\<lambda>_. vc) (canGrant_'_update (\<lambda>_. vb) (badge_'_update (\<lambda>_. va) (ep_'_update (\<lambda>_. ep_Ptr v) s))))) \<in> UNIV \<inter> \<lbrace>\<acute>block = block\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge cp\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cp)\<rbrace> \<inter> \<lbrace>\<acute>canGrantReply = from_bool (capEPCanGrantReply cp)\<rbrace> \<inter> \<lbrace>\<acute>ep = ep_Ptr (capEPPtr cp)\<rbrace> \<inter> \<lbrace>capEPBadge cp && mask 28 = capEPBadge cp\<rbrace>} \<inter> ?R'16102 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va vb vc rva}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}
 7. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 8. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 9. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R15559 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread err) (?Q''16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R16109 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap)) rv thread\<rbrace> liftE (sendIPC isBlocking isCall (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp) thread (capEPPtr cp)) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16102 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap)) rv xfdc (capEPPtr_CL (cap_endpoint_cap_lift cap)) (capEPBadge_CL (cap_endpoint_cap_lift cap)) (capCanGrant_CL (cap_endpoint_cap_lift cap)) (capCanGrantReply_CL (cap_endpoint_cap_lift cap)) thread) \<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap)),capEPBadge_CL (cap_endpoint_cap_lift cap),capCanGrant_CL (cap_endpoint_cap_lift cap),capCanGrantReply_CL (cap_endpoint_cap_lift cap),from_bool isBlocking,from_bool isCall) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' s)) \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''16101 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread err (ret__unsigned_long_' s) (errstate s)))}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R15559 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and ep_at' (capEPPtr cp) and sch_act_sane and (\<lambda>s. rv = ksCurThread s \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) and ?R16109 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned a rv) b\<rbrace>
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vb v'. vb = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vc v'. vc = capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_4_' := vc\<rparr> \<in> {sa. sa \<in> {sa. \<forall>rva. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rva \<longrightarrow> sa \<in> {s. call_'_update (\<lambda>_. calla) (block_'_update (\<lambda>_. block) (canGrantReply_'_update (\<lambda>_. vc) (canGrant_'_update (\<lambda>_. vb) (badge_'_update (\<lambda>_. va) (ep_'_update (\<lambda>_. ep_Ptr v) s))))) \<in> UNIV \<inter> \<lbrace>\<acute>block = block\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge cp\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cp)\<rbrace> \<inter> \<lbrace>\<acute>canGrantReply = from_bool (capEPCanGrantReply cp)\<rbrace> \<inter> \<lbrace>\<acute>ep = ep_Ptr (capEPPtr cp)\<rbrace> \<inter> \<lbrace>capEPBadge cp && mask 28 = capEPBadge cp\<rbrace>} \<inter> ?R'16102 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va vb vc rva}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 7. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 8. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R15559 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (7 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R16109 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap)) rv thread\<rbrace> liftE (sendIPC isBlocking isCall (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp) thread (capEPPtr cp)) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16102 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap)) rv xfdc (capEPPtr_CL (cap_endpoint_cap_lift cap)) (capEPBadge_CL (cap_endpoint_cap_lift cap)) (capCanGrant_CL (cap_endpoint_cap_lift cap)) (capCanGrantReply_CL (cap_endpoint_cap_lift cap)) thread) \<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap)),capEPBadge_CL (cap_endpoint_cap_lift cap),capCanGrant_CL (cap_endpoint_cap_lift cap),capCanGrantReply_CL (cap_endpoint_cap_lift cap),from_bool isBlocking,from_bool isCall) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' s)) \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R15559 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and ep_at' (capEPPtr cp) and sch_act_sane and (\<lambda>s. rv = ksCurThread s \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) and ?R16109 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned a rv) b\<rbrace>
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vb v'. vb = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vc v'. vc = capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_4_' := vc\<rparr> \<in> {sa. sa \<in> {sa. \<forall>rva. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rva \<longrightarrow> sa \<in> {s. call_'_update (\<lambda>_. calla) (block_'_update (\<lambda>_. block) (canGrantReply_'_update (\<lambda>_. vc) (canGrant_'_update (\<lambda>_. vb) (badge_'_update (\<lambda>_. va) (ep_'_update (\<lambda>_. ep_Ptr v) s))))) \<in> UNIV \<inter> \<lbrace>\<acute>block = block\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge cp\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cp)\<rbrace> \<inter> \<lbrace>\<acute>canGrantReply = from_bool (capEPCanGrantReply cp)\<rbrace> \<inter> \<lbrace>\<acute>ep = ep_Ptr (capEPPtr cp)\<rbrace> \<inter> \<lbrace>capEPBadge cp && mask 28 = capEPBadge cp\<rbrace>} \<inter> ?R'16102 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va vb vc rva}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 7. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R15559 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; dc rv xfdc; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16102 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap)) rv xfdc (capEPPtr_CL (cap_endpoint_cap_lift cap)) (capEPBadge_CL (cap_endpoint_cap_lift cap)) (capCanGrant_CL (cap_endpoint_cap_lift cap)) (capCanGrantReply_CL (cap_endpoint_cap_lift cap)) thread) \<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap)),capEPBadge_CL (cap_endpoint_cap_lift cap),capCanGrant_CL (cap_endpoint_cap_lift cap),capCanGrantReply_CL (cap_endpoint_cap_lift cap),from_bool isBlocking,from_bool isCall) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' s)) \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R15559 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and ep_at' (capEPPtr cp) and sch_act_sane and (\<lambda>s. rv = ksCurThread s \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) and (\<lambda>a. True \<and> True)) b\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vb v'. vb = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vc v'. vc = capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_4_' := vc\<rparr> \<in> {sa. sa \<in> {sa. \<forall>rva. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rva \<longrightarrow> sa \<in> {s. call_'_update (\<lambda>_. calla) (block_'_update (\<lambda>_. block) (canGrantReply_'_update (\<lambda>_. vc) (canGrant_'_update (\<lambda>_. vb) (badge_'_update (\<lambda>_. va) (ep_'_update (\<lambda>_. ep_Ptr v) s))))) \<in> UNIV \<inter> \<lbrace>\<acute>block = block\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge cp\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cp)\<rbrace> \<inter> \<lbrace>\<acute>canGrantReply = from_bool (capEPCanGrantReply cp)\<rbrace> \<inter> \<lbrace>\<acute>ep = ep_Ptr (capEPPtr cp)\<rbrace> \<inter> \<lbrace>capEPBadge cp && mask 28 = capEPBadge cp\<rbrace>} \<inter> ?R'16102 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va vb vc rva}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R15559 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb xfdc ret__unsigned unsigned_eret_2 unsigned_eret_3 unsigned_eret_4 thread. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsignedb = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp; ret__unsigned = capEPPtr_CL (cap_endpoint_cap_lift cap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift cap); unsigned_eret_3 = capCanGrant_CL (cap_endpoint_cap_lift cap); unsigned_eret_4 = capCanGrantReply_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16102 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap)) () xfdc (capEPPtr_CL (cap_endpoint_cap_lift cap)) (capEPBadge_CL (cap_endpoint_cap_lift cap)) (capCanGrant_CL (cap_endpoint_cap_lift cap)) (capCanGrantReply_CL (cap_endpoint_cap_lift cap)) thread) \<acute>ret__unsigned_long :== CALL performInvocation_Endpoint_'proc(ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap)),capEPBadge_CL (cap_endpoint_cap_lift cap),capCanGrant_CL (cap_endpoint_cap_lift cap),capCanGrantReply_CL (cap_endpoint_cap_lift cap),from_bool isBlocking,from_bool isCall) UNIV
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R15559 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and ep_at' (capEPPtr cp) and sch_act_sane and (\<lambda>s. rv = ksCurThread s \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) and (\<lambda>a. True \<and> True)) b\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vb v'. vb = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vc v'. vc = capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_4_' := vc\<rparr> \<in> {sa. sa \<in> {sa. \<forall>rva. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rva \<longrightarrow> sa \<in> {s. call_'_update (\<lambda>_. calla) (block_'_update (\<lambda>_. block) (canGrantReply_'_update (\<lambda>_. vc) (canGrant_'_update (\<lambda>_. vb) (badge_'_update (\<lambda>_. va) (ep_'_update (\<lambda>_. ep_Ptr v) s))))) \<in> UNIV \<inter> \<lbrace>\<acute>block = block\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge cp\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cp)\<rbrace> \<inter> \<lbrace>\<acute>canGrantReply = from_bool (capEPCanGrantReply cp)\<rbrace> \<inter> \<lbrace>\<acute>ep = ep_Ptr (capEPPtr cp)\<rbrace> \<inter> \<lbrace>capEPBadge cp && mask 28 = capEPBadge cp\<rbrace>} \<inter> ?R'16102 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va vb vc rva}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R15559 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R15559 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> (invs' and st_tcb_at' simple' rv and ep_at' (capEPPtr cp) and sch_act_sane and (\<lambda>s. rv = ksCurThread s \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p))) and (\<lambda>a. True \<and> True)) b\<rbrace>
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. call_'_update (\<lambda>_. calla) (block_'_update (\<lambda>_. block) (canGrantReply_'_update (\<lambda>_. vc) (canGrant_'_update (\<lambda>_. vb) (badge_'_update (\<lambda>_. va) (ep_'_update (\<lambda>_. ep_Ptr v) s))))) \<in> UNIV \<inter> \<lbrace>\<acute>block = block\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge cp\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cp)\<rbrace> \<inter> \<lbrace>\<acute>canGrantReply = from_bool (capEPCanGrantReply cp)\<rbrace> \<inter> \<lbrace>\<acute>ep = ep_Ptr (capEPPtr cp)\<rbrace> \<inter> \<lbrace>capEPBadge cp && mask 28 = capEPBadge cp\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R15559 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R15559 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. invs' b \<and> st_tcb_at' simple' (ksCurThread b) b \<and> ep_at' (capEPPtr cp) b \<and> sch_act_sane b \<and> (\<forall>a ba. ksCurThread b \<notin> set (ksReadyQueues b (a, ba)))\<rbrace>
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. call_'_update (\<lambda>_. calla) (block_'_update (\<lambda>_. block) (canGrantReply_'_update (\<lambda>_. vc) (canGrant_'_update (\<lambda>_. vb) (badge_'_update (\<lambda>_. va) (ep_'_update (\<lambda>_. ep_Ptr v) s))))) \<in> UNIV \<inter> \<lbrace>\<acute>block = block\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge cp\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cp)\<rbrace> \<inter> \<lbrace>\<acute>canGrantReply = from_bool (capEPCanGrantReply cp)\<rbrace> \<inter> \<lbrace>\<acute>ep = ep_Ptr (capEPPtr cp)\<rbrace> \<inter> \<lbrace>capEPBadge cp && mask 28 = capEPBadge cp\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R15559 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned P. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (ksCurThread s)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>_ s. P (ksCurThread s)\<rbrace>
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned f. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?P16259 cap length___unsigned_long f\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>_ s. invs' s \<and> st_tcb_at' simple' f s \<and> ep_at' (capEPPtr cp) s \<and> sch_act_sane s \<and> (\<forall>a b. f \<notin> set (ksReadyQueues s (a, b)))\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. call_'_update (\<lambda>_. calla) (block_'_update (\<lambda>_. block) (canGrantReply_'_update (\<lambda>_. vc) (canGrant_'_update (\<lambda>_. vb) (badge_'_update (\<lambda>_. va) (ep_'_update (\<lambda>_. ep_Ptr v) s))))) \<in> UNIV \<inter> \<lbrace>\<acute>block = block\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge cp\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cp)\<rbrace> \<inter> \<lbrace>\<acute>canGrantReply = from_bool (capEPCanGrantReply cp)\<rbrace> \<inter> \<lbrace>\<acute>ep = ep_Ptr (capEPPtr cp)\<rbrace> \<inter> \<lbrace>capEPBadge cp && mask 28 = capEPBadge cp\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R15559 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long s. ?P16259 cap length___unsigned_long (ksCurThread s) s \<equiv>\<^sup>? \<lambda>cap length___unsigned_long. ?R15559 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) proof (prove)
goal (4 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. call_'_update (\<lambda>_. calla) (block_'_update (\<lambda>_. block) (canGrantReply_'_update (\<lambda>_. vc) (canGrant_'_update (\<lambda>_. vb) (badge_'_update (\<lambda>_. va) (ep_'_update (\<lambda>_. ep_Ptr v) s))))) \<in> UNIV \<inter> \<lbrace>\<acute>block = block\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge cp\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant cp)\<rbrace> \<inter> \<lbrace>\<acute>canGrantReply = from_bool (capEPCanGrantReply cp)\<rbrace> \<inter> \<lbrace>\<acute>ep = ep_Ptr (capEPPtr cp)\<rbrace> \<inter> \<lbrace>capEPBadge cp && mask 28 = capEPBadge cp\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap); capEPCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15552 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capCanSend_CL (cap_endpoint_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'15552 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isNotificationCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; isEndpointCap cp; ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'15497 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'15497 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R15256 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T15258 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isNotificationCap cp THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> ?R15256 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> ?T15258 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16373 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S16376 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ?Q16373 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> ?S16376 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16373 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S16376 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
(IF \<acute>ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ?Q16373 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> ?S16376 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16373 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?G'16413 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF ret__unsigned = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ?Q16373 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'16413 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16373 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?G'16413 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] (if capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) >>= invocationCatch thread isBlocking isCall id else (if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF capNtfnCanSend_CL (cap_notification_cap_lift cap) = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ?Q16373 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'16413 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (\<not> capNtfnCanSend cp) = (s' \<in> \<lbrace>capNtfnCanSend_CL (cap_notification_cap_lift cap) = 0\<rbrace>)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); \<not> capNtfnCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16603 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'16599 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] ((if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U16601 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'16595 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] (returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> ?R16603 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ?U16601 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?R'16599 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'16595 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>cap length___unsigned_long v0 v1 v2 v3 s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; ccap_relation (capability.NotificationCap v0 v1 v2 v3) cap; unat length___unsigned_long = length args; cp = capability.NotificationCap v0 v1 v2 v3; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<not> v2) = (capNtfnCanSend_CL (cap_notification_cap_lift cap) = 0)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); \<not> capNtfnCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16603 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'16599 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] ((if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U16601 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'16595 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] (returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> ?R16603 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ?U16601 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?R'16599 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'16595 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>cap length___unsigned_long v0 v1 v2 v3 s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; ccap_relation (capability.NotificationCap v0 v1 v2 v3) cap; unat length___unsigned_long = length args; cp = capability.NotificationCap v0 v1 v2 v3; (s, s') \<in> rf_sr; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrakk> \<Longrightarrow> (\<not> v2) = (capNtfnCanSend_CL (cap_notification_cap_lift cap) = 0)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); \<not> capNtfnCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16603 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'16599 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] ((if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U16601 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'16595 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] (returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> ?R16603 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ?U16601 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?R'16599 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'16595 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>cap length___unsigned_long v0 v1 v2 v3 s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; cp = capability.NotificationCap v0 v1 v2 v3; (s, s') \<in> rf_sr; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; capability.NotificationCap v0 v1 v2 v3 = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift cap)))\<rbrakk> \<Longrightarrow> (\<not> v2) = (capNtfnCanSend_CL (cap_notification_cap_lift cap) = 0)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); \<not> capNtfnCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16603 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'16599 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] ((if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U16601 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'16595 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] (returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> ?R16603 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ?U16601 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?R'16599 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'16595 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); \<not> capNtfnCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16603 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'16599 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] ((if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U16601 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'16595 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] (returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> ?R16603 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ?U16601 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?R'16599 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'16595 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); \<not> capNtfnCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16603 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'16599 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] (throwError (Inl (Fault_H.syscall_error.InvalidCapability 0))) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U16601 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'16595 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] (returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> ?R16603 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ?U16601 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?R'16599 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'16595 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); \<not> capNtfnCanSend cp\<rbrakk> \<Longrightarrow> syscall_error_to_H (invalidCapNumber_C_update (\<lambda>_. 0) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) err')) ft' = Some (Fault_H.syscall_error.InvalidCapability 0)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U16601 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'16595 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] (returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ?U16601 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'16595 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U16601 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'16595 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] (returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ?U16601 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'16595 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U16601 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'16595 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE x <- liftE (sendSignal (capNtfnPtr cp) (capNtfnBadge cp));
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ?U16601 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'16595 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U16601 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'16595 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
x <- sendSignal (capNtfnPtr cp) (capNtfnBadge cp);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ?U16601 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> ?U'16595 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16648 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv) (?Q'16648 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv xfdc) [SKIP] (do x <- sendSignal (capNtfnPtr cp) (capNtfnBadge cp);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R16656 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q16648 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16649 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'16648 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s)}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R16656 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'16649 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsignedb = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp; dc rv xfdc; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16648 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv) (?G'16707 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned) [SKIP] (do x <- sendSignal (capNtfnPtr cp) (capNtfnBadge cp);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr ret__unsigned,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R16656 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q16648 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16649 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'16707 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R16656 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'16649 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsignedb = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp; dc rv xfdc; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16648 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv) (?G'16819 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2) [SKIP] (do x <- sendSignal (capNtfnPtr cp) (capNtfnBadge cp);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr ret__unsigned,unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R16656 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q16648 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16649 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> ?G'16819 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R16656 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'16649 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsignedb = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp; dc rv xfdc; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16648 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) rv) (?G'16819 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) rv xfdc (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap))) [SKIP] (doE x <- liftE (sendSignal (capNtfnPtr cp) (capNtfnBadge cp));
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
odE) (\<acute>ret__unsigned_long :== CALL performInvocation_Notification_'proc(ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap)),capNtfnBadge_CL (cap_notification_cap_lift cap));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R16656 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q16648 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16649 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> ?G'16819 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R16656 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'16649 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (8 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsignedb = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp; dc rv xfdc; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap); dc rva (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16901 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 rva) (?Q'16923 cap length___unsigned_long rv xfdc rva ret__unsigned_long) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsignedb = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp; dc rv xfdc; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16901 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 err) (?Q''16921 cap length___unsigned_long rv xfdc err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsignedb = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp; dc rv xfdc; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R16913 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) rv\<rbrace> liftE (sendSignal (capNtfnPtr cp) (capNtfnBadge cp)) \<lbrace>?Q16901 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2\<rbrace>, \<lbrace>?QE16901 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2\<rbrace>
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R16656 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and ?R16913 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned a\<rbrace>
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16649 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. badge_'_update (\<lambda>_. va) (ntfn_'_update (\<lambda>_. ntfn_Ptr v) sa) \<in> UNIV \<inter> \<lbrace>\<acute>ntfn = ntfn_Ptr (capNtfnPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>badge = capNtfnBadge cp\<rbrace> \<inter> {sa. ?message_'16919 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va sa = ?message16924 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va}} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. dc rva (K () (ret__unsigned_long_' t)) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'16922 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va t rva)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''16920 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va t err))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 7. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 8. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R16656 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'16649 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long rv xfdc t rva. ?Q'16923 cap length___unsigned_long rv xfdc rva (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long rv xfdc. ?Q'16922 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) rv xfdc (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap))
\<lambda>cap length___unsigned_long rv xfdc t err. ?Q''16921 cap length___unsigned_long rv xfdc err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long rv xfdc. ?Q''16920 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) rv xfdc (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (8 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsignedb = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp; dc rv xfdc; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap); dc rva (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16901 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 rva) (?Q'16923 cap length___unsigned_long rv xfdc rva ret__unsigned_long) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsignedb = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp; dc rv xfdc; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16901 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 err) (?Q''16921 cap length___unsigned_long rv xfdc err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsignedb = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp; dc rv xfdc; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R16913 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) rv\<rbrace> liftE (sendSignal (capNtfnPtr cp) (capNtfnBadge cp)) \<lbrace>?Q16901 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2\<rbrace>, \<lbrace>?QE16901 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2\<rbrace>
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R16656 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and ?R16913 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned a\<rbrace>
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16649 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. badge_'_update (\<lambda>_. va) (ntfn_'_update (\<lambda>_. ntfn_Ptr v) sa) \<in> UNIV \<inter> \<lbrace>\<acute>ntfn = ntfn_Ptr (capNtfnPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>badge = capNtfnBadge cp\<rbrace> \<inter> {sa. ?message_'16919 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va sa = ?message16924 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va}} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. dc rva (K () (ret__unsigned_long_' t)) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'16922 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va t rva)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''16920 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va t err))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 7. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 8. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R16656 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'16649 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long rv xfdc t rva. ?Q'16923 cap length___unsigned_long rv xfdc rva (ret__unsigned_long_' t) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long rv xfdc. ?Q'16922 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) rv xfdc (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap))
\<lambda>cap length___unsigned_long rv xfdc t err. ?Q''16921 cap length___unsigned_long rv xfdc err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long rv xfdc. ?Q''16920 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) rv xfdc (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (7 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsignedb = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp; dc rv xfdc; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16901 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 err) (?Q''16921 cap length___unsigned_long rv xfdc err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsignedb = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp; dc rv xfdc; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R16913 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) rv\<rbrace> liftE (sendSignal (capNtfnPtr cp) (capNtfnBadge cp)) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE16901 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R16656 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and ?R16913 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned a\<rbrace>
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16649 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. badge_'_update (\<lambda>_. va) (ntfn_'_update (\<lambda>_. ntfn_Ptr v) sa) \<in> UNIV \<inter> \<lbrace>\<acute>ntfn = ntfn_Ptr (capNtfnPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>badge = capNtfnBadge cp\<rbrace> \<inter> {sa. ?message_'16919 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va sa = ?message16924 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va}} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''16920 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va t err))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 7. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R16656 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'16649 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long rv xfdc t err. ?Q''16921 cap length___unsigned_long rv xfdc err (ret__unsigned_long_' t) (errstate t) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long rv xfdc. ?Q''16920 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) rv xfdc (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsignedb = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp; dc rv xfdc; ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R16913 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) rv\<rbrace> liftE (sendSignal (capNtfnPtr cp) (capNtfnBadge cp)) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R16656 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and ?R16913 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned a\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16649 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. badge_'_update (\<lambda>_. va) (ntfn_'_update (\<lambda>_. ntfn_Ptr v) sa) \<in> UNIV \<inter> \<lbrace>\<acute>ntfn = ntfn_Ptr (capNtfnPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>badge = capNtfnBadge cp\<rbrace> \<inter> {sa. ?message_'16919 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va sa = ?message16924 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va}} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R16656 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'16649 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<lbrace>?R16656 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and (\<lambda>a. True \<and> True)\<rbrace>
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16649 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. badge_'_update (\<lambda>_. va) (ntfn_'_update (\<lambda>_. ntfn_Ptr v) sa) \<in> UNIV \<inter> \<lbrace>\<acute>ntfn = ntfn_Ptr (capNtfnPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>badge = capNtfnBadge cp\<rbrace> \<inter> {sa. ?message_'16919 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va sa = ?message16924 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va}} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R16656 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'16649 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16649 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. badge_'_update (\<lambda>_. va) (ntfn_'_update (\<lambda>_. ntfn_Ptr v) sa) \<in> UNIV \<inter> \<lbrace>\<acute>ntfn = ntfn_Ptr (capNtfnPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>badge = capNtfnBadge cp\<rbrace> \<inter> {sa. ?message_'16919 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va sa = ?message16924 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va}} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'16649 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); capNtfnCanSend cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16649 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc s) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>))) = ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc s) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'16649 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isReplyCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; isNotificationCap cp; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'16597 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap))) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'16597 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16372 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T16374 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isReplyCap cp THEN
  \<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> ?R16372 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> ?T16374 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17107 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S17110 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ?Q17107 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> ?S17110 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17107 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S17110 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (if \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) >>= invocationCatch thread isBlocking isCall id else (if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ?Q17107 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> ?S17110 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17107 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S17110 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (if \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) >>= invocationCatch thread isBlocking isCall id else (if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyMaster_'proc(cap);;
(IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ?Q17107 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> ?S17110 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17107 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?G'17149 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (if \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) >>= invocationCatch thread isBlocking isCall id else (if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF ret__unsigned \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ?Q17107 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'17149 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (\<not> \<not> capReplyMaster cp) = (s' \<in> \<lbrace>ret__unsigned \<noteq> 0\<rbrace>)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17369 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'17365 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] ((if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U17367 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'17361 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> ?R17369 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ?U17367 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?R'17365 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?U'17361 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (6 subgoals):
 1. \<And>cap length___unsigned_long v0 v1 v2 s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; ccap_relation (capability.ReplyCap v0 v1 v2) cap; unat length___unsigned_long = length args; cp = capability.ReplyCap v0 v1 v2; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> v1 = (capReplyMaster_CL (cap_reply_cap_lift cap) \<noteq> 0)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17369 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'17365 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] ((if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U17367 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'17361 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> ?R17369 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ?U17367 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?R'17365 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?U'17361 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (6 subgoals):
 1. \<And>cap length___unsigned_long v0 v1 v2 s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; ccap_relation (capability.ReplyCap v0 v1 v2) cap; unat length___unsigned_long = length args; cp = capability.ReplyCap v0 v1 v2; (s, s') \<in> rf_sr; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrakk> \<Longrightarrow> v1 = (capReplyMaster_CL (cap_reply_cap_lift cap) \<noteq> 0)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17369 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'17365 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] ((if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U17367 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'17361 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> ?R17369 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ?U17367 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?R'17365 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?U'17361 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17369 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'17365 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] ((if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U17367 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'17361 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> ?R17369 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ?U17367 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?R'17365 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?U'17361 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); capReplyMaster cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17369 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?R'17365 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) [SKIP] (throwError (Inl (Fault_H.syscall_error.InvalidCapability 0))) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U17367 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'17361 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> ?R17369 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ?U17367 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?R'17365 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?U'17361 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); capReplyMaster cp\<rbrakk> \<Longrightarrow> syscall_error_to_H (invalidCapNumber_C_update (\<lambda>_. 0) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) err')) ft' = Some (Fault_H.syscall_error.InvalidCapability 0)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U17367 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'17361 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ?U17367 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?U'17361 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (4 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U17367 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'17361 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) >>= invocationCatch thread isBlocking isCall id) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ?U17367 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?U'17361 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (4 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?U17367 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?U'17361 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
sender <- getCurThread;
y <- doReplyTransfer sender (capTCBPtr cp) slot (capReplyCanGrant cp);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ?U17367 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?U'17361 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17409 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv) (?Q'17409 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv xfdc) [SKIP] (do sender <- getCurThread;
y <- doReplyTransfer sender (capTCBPtr cp) slot (capReplyCanGrant cp);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (\<acute>ret__unsigned :== CALL cap_reply_cap_get_capTCBPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<lbrace>?R17417 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q17409 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'17409 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s)}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R17417 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17409 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv) (?G'17477 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned) [SKIP] (do sender <- getCurThread;
y <- doReplyTransfer sender (capTCBPtr cp) slot (capReplyCanGrant cp);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (\<acute>unsigned_eret_2 :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,\<acute>unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<lbrace>?R17417 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q17409 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'17477 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R17417 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17409 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv) (?G'17609 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2) [SKIP] (do sender <- getCurThread;
y <- doReplyTransfer sender (capTCBPtr cp) slot (capReplyCanGrant cp);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<lbrace>?R17417 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q17409 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> ?G'17609 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R17417 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?P17705 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv a sender) (?P'17703 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender) [SKIP] (do y <- doReplyTransfer sender (capTCBPtr cp) slot (capReplyCanGrant cp);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,unsigned_eret_2);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<lbrace>?R17417 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> ?P17705 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned a b rv\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>rva. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rva \<longrightarrow> sa \<in> ?P'17703 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va rva}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R17417 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?P17705 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap)) rv a sender) (?P'17703 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap)) rv xfdc (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) (capReplyCanGrant_CL (cap_reply_cap_lift cap)) sender) [SKIP] (doE y <- liftE (doReplyTransfer sender (capTCBPtr cp) slot (capReplyCanGrant cp));
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
odE) (\<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)),cte_Ptr slot,capReplyCanGrant_CL (cap_reply_cap_lift cap));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<lbrace>?R17417 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> ?P17705 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned a b rv\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>rva. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rva \<longrightarrow> sa \<in> ?P'17703 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va rva}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R17417 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (9 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap); dc rva (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender rva) (?Q'17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender rva ret__unsigned_long) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender err) (?Q''17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R17720 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap)) rv sender\<rbrace> liftE (doReplyTransfer sender (capTCBPtr cp) slot (capReplyCanGrant cp)) \<lbrace>?Q17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender\<rbrace>, \<lbrace>?QE17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender\<rbrace>
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17713 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap)) rv xfdc (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) (capReplyCanGrant_CL (cap_reply_cap_lift cap)) sender) \<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)),cte_Ptr slot,capReplyCanGrant_CL (cap_reply_cap_lift cap)) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. dc rva (K () (ret__unsigned_long_' s)) \<longrightarrow> s \<in> ?Q'17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender rva (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<lbrace>?R17417 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> (invs' and tcb_at' (capTCBPtr cp) and st_tcb_at' active' rv and sch_act_simple and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot and (\<lambda>s. ksCurThread s = rv) and ?R17720 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned a rv) b\<rbrace>
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>rva. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rva \<longrightarrow> sa \<in> {s. canGrant_'_update (\<lambda>_. va) (slot_'_update (\<lambda>_. slota) (thread_'_update (\<lambda>_. tcb_Ptr v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capReplyCanGrant cp)\<rbrace>} \<inter> ?R'17713 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va rva}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}
 7. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 8. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 9. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R17417 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (9 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap); dc rva (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender rva) (?Q'17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender rva ret__unsigned_long) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>a. ret__unsigned_long))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender err) (?Q''17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R17720 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap)) rv sender\<rbrace> liftE (doReplyTransfer sender (capTCBPtr cp) slot (capReplyCanGrant cp)) \<lbrace>?Q17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender\<rbrace>, \<lbrace>?QE17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender\<rbrace>
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17713 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap)) rv xfdc (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) (capReplyCanGrant_CL (cap_reply_cap_lift cap)) sender) \<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)),cte_Ptr slot,capReplyCanGrant_CL (cap_reply_cap_lift cap)) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. dc rva (K () (ret__unsigned_long_' s)) \<longrightarrow> s \<in> ?Q'17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender rva (ret__unsigned_long_' s))) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender err (ret__unsigned_long_' s) (errstate s)))}
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<lbrace>?R17417 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> (invs' and tcb_at' (capTCBPtr cp) and st_tcb_at' active' rv and sch_act_simple and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot and (\<lambda>s. ksCurThread s = rv) and ?R17720 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned a rv) b\<rbrace>
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>rva. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rva \<longrightarrow> sa \<in> {s. canGrant_'_update (\<lambda>_. va) (slot_'_update (\<lambda>_. slota) (thread_'_update (\<lambda>_. tcb_Ptr v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capReplyCanGrant cp)\<rbrace>} \<inter> ?R'17713 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va rva}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}
 7. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 8. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 9. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R17417 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (8 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender err) (?Q''17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_longa ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R17720 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap)) rv sender\<rbrace> liftE (doReplyTransfer sender (capTCBPtr cp) slot (capReplyCanGrant cp)) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17713 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap)) rv xfdc (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) (capReplyCanGrant_CL (cap_reply_cap_lift cap)) sender) \<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)),cte_Ptr slot,capReplyCanGrant_CL (cap_reply_cap_lift cap)) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' s)) \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''17712 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender err (ret__unsigned_long_' s) (errstate s)))}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<lbrace>?R17417 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> (invs' and tcb_at' (capTCBPtr cp) and st_tcb_at' active' rv and sch_act_simple and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot and (\<lambda>s. ksCurThread s = rv) and ?R17720 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned a rv) b\<rbrace>
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>rva. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rva \<longrightarrow> sa \<in> {s. canGrant_'_update (\<lambda>_. va) (slot_'_update (\<lambda>_. slota) (thread_'_update (\<lambda>_. tcb_Ptr v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capReplyCanGrant cp)\<rbrace>} \<inter> ?R'17713 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va rva}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 7. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 8. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R17417 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (7 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R17720 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap)) rv sender\<rbrace> liftE (doReplyTransfer sender (capTCBPtr cp) slot (capReplyCanGrant cp)) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17713 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap)) rv xfdc (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) (capReplyCanGrant_CL (cap_reply_cap_lift cap)) sender) \<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)),cte_Ptr slot,capReplyCanGrant_CL (cap_reply_cap_lift cap)) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' s)) \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<lbrace>?R17417 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> (invs' and tcb_at' (capTCBPtr cp) and st_tcb_at' active' rv and sch_act_simple and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot and (\<lambda>s. ksCurThread s = rv) and ?R17720 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned a rv) b\<rbrace>
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>rva. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rva \<longrightarrow> sa \<in> {s. canGrant_'_update (\<lambda>_. va) (slot_'_update (\<lambda>_. slota) (thread_'_update (\<lambda>_. tcb_Ptr v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capReplyCanGrant cp)\<rbrace>} \<inter> ?R'17713 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va rva}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 7. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R17417 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb rv xfdc ret__unsigned unsigned_eret_2 sender. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; dc rv xfdc; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17713 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap)) rv xfdc (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) (capReplyCanGrant_CL (cap_reply_cap_lift cap)) sender) \<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)),cte_Ptr slot,capReplyCanGrant_CL (cap_reply_cap_lift cap)) {s. (id (ret__unsigned_long_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' s)) \<longrightarrow> s \<in> \<lbrace>id \<^bsup>s\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () \<^bsup>s\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' s)) (errstate s) \<longrightarrow> s \<in> {sa. id (ret__unsigned_long_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' s)) (errstate sa)}))}
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<lbrace>?R17417 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> (invs' and tcb_at' (capTCBPtr cp) and st_tcb_at' active' rv and sch_act_simple and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot and (\<lambda>s. ksCurThread s = rv) and (\<lambda>a. True \<and> True)) b\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>rva. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rva \<longrightarrow> sa \<in> {s. canGrant_'_update (\<lambda>_. va) (slot_'_update (\<lambda>_. slota) (thread_'_update (\<lambda>_. tcb_Ptr v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capReplyCanGrant cp)\<rbrace>} \<inter> ?R'17713 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va rva}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R17417 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsignedb xfdc ret__unsigned unsigned_eret_2 sender. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsignedb = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp; ret__unsigned = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap); unsigned_eret_2 = capReplyCanGrant_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17713 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap)) () xfdc (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) (capReplyCanGrant_CL (cap_reply_cap_lift cap)) sender) \<acute>ret__unsigned_long :== CALL performInvocation_Reply_'proc(tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)),cte_Ptr slot,capReplyCanGrant_CL (cap_reply_cap_lift cap)) UNIV
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<lbrace>?R17417 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> (invs' and tcb_at' (capTCBPtr cp) and st_tcb_at' active' rv and sch_act_simple and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot and (\<lambda>s. ksCurThread s = rv) and (\<lambda>a. True \<and> True)) b\<rbrace>
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. sa \<in> {sa. \<forall>rva. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rva \<longrightarrow> sa \<in> {s. canGrant_'_update (\<lambda>_. va) (slot_'_update (\<lambda>_. slota) (thread_'_update (\<lambda>_. tcb_Ptr v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capReplyCanGrant cp)\<rbrace>} \<inter> ?R'17713 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned rv (xfdc s) v va rva}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R17417 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<lbrace>?R17417 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. \<forall>rv. ksCurThread b = rv \<longrightarrow> (invs' and tcb_at' (capTCBPtr cp) and st_tcb_at' active' rv and sch_act_simple and (Not \<circ> real_cte_at' slot or cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot) and cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot and (\<lambda>s. ksCurThread s = rv) and (\<lambda>a. True \<and> True)) b\<rbrace>
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. canGrant_'_update (\<lambda>_. va) (slot_'_update (\<lambda>_. slota) (thread_'_update (\<lambda>_. tcb_Ptr v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capReplyCanGrant cp)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R17417 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<lbrace>?R17417 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. invs' b \<and> tcb_at' (capTCBPtr cp) b \<and> st_tcb_at' active' (ksCurThread b) b \<and> sch_act_simple b \<and> (real_cte_at' slot b \<longrightarrow> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot b) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot b\<rbrace>
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. canGrant_'_update (\<lambda>_. va) (slot_'_update (\<lambda>_. slota) (thread_'_update (\<lambda>_. tcb_Ptr v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capReplyCanGrant cp)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R17417 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<lbrace>?R17417 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>r s. ksCurThread s = thread \<and> invs' s \<and> tcb_at' (capTCBPtr cp) s \<and> st_tcb_at' active' (ksCurThread s) s \<and> sch_act_simple s \<and> (real_cte_at' slot s \<longrightarrow> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot s\<rbrace>
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. canGrant_'_update (\<lambda>_. va) (slot_'_update (\<lambda>_. slota) (thread_'_update (\<lambda>_. tcb_Ptr v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capReplyCanGrant cp)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R17417 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<lbrace>?R17417 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>r s. ksCurThread s = thread \<and> invs' s \<and> tcb_at' (capTCBPtr cp) s \<and> st_tcb_at' active' thread s \<and> sch_act_simple s \<and> (real_cte_at' slot s \<longrightarrow> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot s\<rbrace>
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. canGrant_'_update (\<lambda>_. va) (slot_'_update (\<lambda>_. slota) (thread_'_update (\<lambda>_. tcb_Ptr v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capReplyCanGrant cp)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R17417 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<lbrace>?R17417 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>r s. ksCurThread s = thread \<and> invs' s \<and> tcb_at' (capTCBPtr cp) s \<and> st_tcb_at' active' thread s \<and> sch_act_simple s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) slot s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap \<or> isReplyCap (cteCap cte)) slot s\<rbrace>
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. canGrant_'_update (\<lambda>_. va) (slot_'_update (\<lambda>_. slota) (thread_'_update (\<lambda>_. tcb_Ptr v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capReplyCanGrant cp)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R17417 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (4 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capReplyCanGrant_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. canGrant_'_update (\<lambda>_. va) (slot_'_update (\<lambda>_. slota) (thread_'_update (\<lambda>_. tcb_Ptr v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capReplyCanGrant cp)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}}
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (4 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap); \<not> capReplyMaster cp\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'17410 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capReplyMaster_CL (cap_reply_cap_lift cap))) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'17410 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isThreadCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; isReplyCap cp; ret__unsigned = capReplyMaster_CL (cap_reply_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'17363 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> ?PT'17363 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb) \<and> (s \<notin> \<lbrace>vb \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17106 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T17108 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isThreadCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> ?R17106 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> ?T17108 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; isThreadCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18011 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18014 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18010 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18012 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> ?Q18011 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isThreadCap cp \<longrightarrow> ?R18010 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> ?S18014 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> ?T18012 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; isThreadCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18011 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18014 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18010 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18012 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> ?Q18011 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isThreadCap cp \<longrightarrow> ?R18010 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> ?S18014 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> ?T18012 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; isThreadCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18011 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18014 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18010 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18012 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> ?Q18011 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isThreadCap cp \<longrightarrow> ?R18010 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> ?S18014 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> ?T18012 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; isThreadCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18011 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18014 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (decodeTCBInvocation label args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL decodeTCBInvocation_'proc(label,length___unsigned_long,cap,cte_Ptr slot,from_bool isCall,option_to_ptr buffer))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18010 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18012 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> ?Q18011 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isThreadCap cp \<longrightarrow> ?R18010 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> ?S18014 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> ?T18012 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (6 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; isThreadCap cp\<rbrakk> \<Longrightarrow> interpret_excaps (?extraCaps'18041 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) = excaps_map extraCaps
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned s ta sa. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; isThreadCap cp\<rbrakk> \<Longrightarrow> globals (sa\<lparr>ret__unsigned_long_' := ret__unsigned_long_' ta\<rparr>) = globals sa
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned a s t. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; isThreadCap cp\<rbrakk> \<Longrightarrow> liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>) = liftxf errstate id (K ()) ret__unsigned_long_' t
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; isThreadCap cp\<rbrakk> \<Longrightarrow> globals (buffer_'_update (\<lambda>_. option_to_ptr buffer) (call_'_update (\<lambda>_. from_bool isCall) (slot_'_update (\<lambda>_. cte_Ptr slot) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := label, length___unsigned_long_' := length___unsigned_long\<rparr>))))) = globals s
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18010 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18012 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 6. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> ?R18010 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = ?extraCaps'18041 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> ?T18012 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (5 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned s ta sa. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; isThreadCap cp\<rbrakk> \<Longrightarrow> globals (sa\<lparr>ret__unsigned_long_' := ret__unsigned_long_' ta\<rparr>) = globals sa
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned a s t. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; isThreadCap cp\<rbrakk> \<Longrightarrow> liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>) = liftxf errstate id (K ()) ret__unsigned_long_' t
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isCNodeCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp \<and> cp \<noteq> capability.DomainCap; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; isThreadCap cp\<rbrakk> \<Longrightarrow> globals (buffer_'_update (\<lambda>_. option_to_ptr buffer) (call_'_update (\<lambda>_. from_bool isCall) (slot_'_update (\<lambda>_. cte_Ptr slot) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := label, length___unsigned_long_' := length___unsigned_long\<rparr>))))) = globals s
 4. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18010 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18012 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 5. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> ?R18010 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> ?T18012 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18010 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18012 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF cp = capability.DomainCap THEN
  \<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> ?R18010 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> ?T18012 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18050 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18053 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18049 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18051 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> ?Q18050 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> ?R18049 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> ?S18053 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> ?T18051 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation capability.DomainCap cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isZombie capability.DomainCap \<and> \<not> isArchObjectCap capability.DomainCap \<and> \<not> isThreadCap capability.DomainCap \<and> \<not> isCNodeCap capability.DomainCap \<and> \<not> isNotificationCap capability.DomainCap \<and> \<not> isEndpointCap capability.DomainCap \<and> \<not> isReplyCap capability.DomainCap \<and> \<not> isIRQControlCap capability.DomainCap \<and> \<not> isIRQHandlerCap capability.DomainCap; ret__unsigned = cap_get_tag cap; cp = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18050 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18053 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18049 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18051 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> ?Q18050 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> ?R18049 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> ?S18053 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> ?T18051 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation capability.DomainCap cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isZombie capability.DomainCap \<and> \<not> isArchObjectCap capability.DomainCap \<and> \<not> isThreadCap capability.DomainCap \<and> \<not> isCNodeCap capability.DomainCap \<and> \<not> isNotificationCap capability.DomainCap \<and> \<not> isEndpointCap capability.DomainCap \<and> \<not> isReplyCap capability.DomainCap \<and> \<not> isIRQControlCap capability.DomainCap \<and> \<not> isIRQHandlerCap capability.DomainCap; ret__unsigned = cap_get_tag cap; cp = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18050 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18053 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (decodeDomainInvocation label args extraCaps >>= invocationCatch thread isBlocking isCall (uncurry Invocations_H.invocation.InvokeDomain)) (\<acute>ret__unsigned_long :== CALL decodeDomainInvocation_'proc(label,length___unsigned_long,option_to_ptr buffer))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18049 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18051 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> ?Q18050 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> ?R18049 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> ?S18053 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> ?T18051 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18049 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18051 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isCNodeCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> ?R18049 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> ?T18051 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; isCNodeCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18115 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18118 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18114 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18116 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> ?Q18115 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isCNodeCap cp \<longrightarrow> ?R18114 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> ?S18118 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> ?T18116 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; isCNodeCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18115 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18118 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18114 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18116 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> ?Q18115 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isCNodeCap cp \<longrightarrow> ?R18114 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> ?S18118 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> ?T18116 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; isCNodeCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18115 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18118 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18114 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18116 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> ?Q18115 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isCNodeCap cp \<longrightarrow> ?R18114 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> ?S18118 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> ?T18116 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isUntypedCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; isCNodeCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18115 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18118 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (decodeCNodeInvocation label args cp (map fst extraCaps) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeCNode) (\<acute>ret__unsigned_long :== CALL decodeCNodeInvocation_'proc(label,length___unsigned_long,cap,option_to_ptr buffer))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18114 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18116 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> ?Q18115 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isCNodeCap cp \<longrightarrow> ?R18114 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> ?S18118 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> ?T18116 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18114 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18116 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isUntypedCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> ?R18114 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> ?T18116 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; isUntypedCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18152 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18155 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18151 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18153 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> ?Q18152 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isUntypedCap cp \<longrightarrow> ?R18151 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> ?S18155 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> ?T18153 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; isUntypedCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18152 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18155 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18151 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18153 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> ?Q18152 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isUntypedCap cp \<longrightarrow> ?R18151 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> ?S18155 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> ?T18153 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; isUntypedCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18152 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18155 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18151 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18153 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> ?Q18152 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isUntypedCap cp \<longrightarrow> ?R18151 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> ?S18155 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> ?T18153 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isIRQControlCap cp \<and> \<not> isIRQHandlerCap cp; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; isUntypedCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18152 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18155 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (decodeUntypedInvocation label args slot cp (map fst extraCaps) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeUntyped) (\<acute>ret__unsigned_long :== CALL decodeUntypedInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,cap,from_bool isCall,option_to_ptr buffer))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18151 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18153 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> ?Q18152 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isUntypedCap cp \<longrightarrow> ?R18151 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> ?S18155 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> ?T18153 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18151 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18153 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isIRQControlCap cp THEN
  \<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI
FI)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and K (isUntypedCap cp) and cte_wp_at' (\<lambda>cte. cteCap cte = cp) slot and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isUntypedCap cp \<longrightarrow> ?R18151 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> ?T18153 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; isIRQControlCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18190 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18193 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; \<not> isIRQControlCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18189 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18191 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and K (isUntypedCap cp) and cte_wp_at' (\<lambda>cte. cteCap cte = cp) slot and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isUntypedCap cp \<longrightarrow> (isIRQControlCap cp \<longrightarrow> ?Q18190 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isIRQControlCap cp \<longrightarrow> ?R18189 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> {s. (isIRQControlCap cp \<longrightarrow> s \<in> ?S18193 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isIRQControlCap cp \<longrightarrow> s \<in> ?T18191 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isIRQHandlerCap cp; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; isIRQControlCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18190 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18193 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (global.decodeIRQControlInvocation label args slot (map fst extraCaps) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQControl) (\<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; \<not> isIRQControlCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18189 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18191 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and K (isUntypedCap cp) and cte_wp_at' (\<lambda>cte. cteCap cte = cp) slot and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isUntypedCap cp \<longrightarrow> (isIRQControlCap cp \<longrightarrow> ?Q18190 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isIRQControlCap cp \<longrightarrow> ?R18189 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> {s. (isIRQControlCap cp \<longrightarrow> s \<in> ?S18193 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isIRQControlCap cp \<longrightarrow> s \<in> ?T18191 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp \<and> \<not> isIRQHandlerCap cp; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; isIRQControlCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18190 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18193 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (global.decodeIRQControlInvocation label args slot (map fst extraCaps) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQControl) (\<acute>ret__unsigned_long :== CALL decodeIRQControlInvocation_'proc(label,length___unsigned_long,cte_Ptr slot,option_to_ptr buffer))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; \<not> isIRQControlCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18189 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18191 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and K (isUntypedCap cp) and cte_wp_at' (\<lambda>cte. cteCap cte = cp) slot and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isUntypedCap cp \<longrightarrow> (isIRQControlCap cp \<longrightarrow> ?Q18190 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isIRQControlCap cp \<longrightarrow> ?R18189 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> {s. (isIRQControlCap cp \<longrightarrow> s \<in> ?S18193 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isIRQControlCap cp \<longrightarrow> s \<in> ?T18191 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; \<not> isIRQControlCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18189 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18191 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (IF isIRQHandlerCap cp THEN
  \<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  Guard DontReach {} SKIP
FI)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and K (isUntypedCap cp) and cte_wp_at' (\<lambda>cte. cteCap cte = cp) slot and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isUntypedCap cp \<longrightarrow> (isIRQControlCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isIRQControlCap cp \<longrightarrow> ?R18189 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s)))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> {s. (isIRQControlCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (srcSlot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = slota\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isIRQControlCap cp \<longrightarrow> s \<in> ?T18191 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; \<not> isIRQControlCap cp; isIRQHandlerCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18229 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18232 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (\<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; \<not> isIRQControlCap cp; \<not> isIRQHandlerCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18228 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18230 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (Guard DontReach {} SKIP)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and K (isUntypedCap cp) and cte_wp_at' (\<lambda>cte. cteCap cte = cp) slot and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isUntypedCap cp \<longrightarrow> (isIRQControlCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isIRQControlCap cp \<longrightarrow> (isIRQHandlerCap cp \<longrightarrow> ?Q18229 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> ?R18228 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> {s. (isIRQControlCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (srcSlot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = slota\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isIRQControlCap cp \<longrightarrow> s \<in> {s. (isIRQHandlerCap cp \<longrightarrow> s \<in> ?S18232 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> s \<in> ?T18230 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; \<not> isIRQControlCap cp; isIRQHandlerCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18229 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18232 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; \<not> isIRQControlCap cp; \<not> isIRQHandlerCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18228 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18230 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (Guard DontReach {} SKIP)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and K (isUntypedCap cp) and cte_wp_at' (\<lambda>cte. cteCap cte = cp) slot and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isUntypedCap cp \<longrightarrow> (isIRQControlCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isIRQControlCap cp \<longrightarrow> (isIRQHandlerCap cp \<longrightarrow> ?Q18229 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> ?R18228 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> {s. (isIRQControlCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (srcSlot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = slota\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isIRQControlCap cp \<longrightarrow> s \<in> {s. (isIRQHandlerCap cp \<longrightarrow> s \<in> ?S18232 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> s \<in> ?T18230 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; \<not> isIRQControlCap cp; isIRQHandlerCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18229 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?S18232 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned :== CALL cap_irq_handler_cap_get_capIRQ_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,\<acute>ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; \<not> isIRQControlCap cp; \<not> isIRQHandlerCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18228 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18230 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (Guard DontReach {} SKIP)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and K (isUntypedCap cp) and cte_wp_at' (\<lambda>cte. cteCap cte = cp) slot and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isUntypedCap cp \<longrightarrow> (isIRQControlCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isIRQControlCap cp \<longrightarrow> (isIRQHandlerCap cp \<longrightarrow> ?Q18229 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> ?R18228 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> {s. (isIRQControlCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (srcSlot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = slota\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isIRQControlCap cp \<longrightarrow> s \<in> {s. (isIRQHandlerCap cp \<longrightarrow> s \<in> ?S18232 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> s \<in> ?T18230 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; \<not> isIRQControlCap cp; isIRQHandlerCap cp; ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18229 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?G'18261 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) ret__unsigned) [SKIP] (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,ret__unsigned);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; \<not> isIRQControlCap cp; \<not> isIRQHandlerCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18228 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18230 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (Guard DontReach {} SKIP)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and K (isUntypedCap cp) and cte_wp_at' (\<lambda>cte. cteCap cte = cp) slot and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isUntypedCap cp \<longrightarrow> (isIRQControlCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isIRQControlCap cp \<longrightarrow> (isIRQHandlerCap cp \<longrightarrow> ?Q18229 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> ?R18228 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> {s. (isIRQControlCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (srcSlot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = slota\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isIRQControlCap cp \<longrightarrow> s \<in> {s. (isIRQHandlerCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'18261 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> s \<in> ?T18230 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isArchObjectCap cp; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigneda = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; \<not> isIRQControlCap cp; isIRQHandlerCap cp; ret__unsigned = capIRQ_CL (cap_irq_handler_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18229 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?G'18261 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capIRQ_CL (cap_irq_handler_cap_lift cap))) [SKIP] (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned_long :== CALL decodeIRQHandlerInvocation_'proc(label,capIRQ_CL (cap_irq_handler_cap_lift cap)))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true (isZombie cp) + one_on_true (isArchObjectCap cp) + one_on_true (isThreadCap cp) + one_on_true (isCNodeCap cp) + one_on_true (isNotificationCap cp) + one_on_true (isEndpointCap cp) + one_on_true (isUntypedCap cp) + one_on_true (isReplyCap cp) + one_on_true (isIRQControlCap cp) + one_on_true (isIRQHandlerCap cp) + one_on_true (cp = capability.NullCap) + one_on_true (cp = capability.DomainCap) = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; \<not> isIRQControlCap cp; \<not> isIRQHandlerCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18228 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18230 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isEndpointCap cp \<and> capEPCanSend cp then returnOk (Invocations_H.invocation.InvokeEndpoint (capEPPtr cp) (capEPBadge cp) (capEPCanGrant cp) (capEPCanGrantReply cp)) else if isNotificationCap cp \<and> capNtfnCanSend cp then returnOk (Invocations_H.invocation.InvokeNotification (capNtfnPtr cp) (capNtfnBadge cp)) else if isReplyCap cp \<and> \<not> capReplyMaster cp then returnOk (Invocations_H.invocation.InvokeReply (capTCBPtr cp) slot (capReplyCanGrant cp)) else if isThreadCap cp then liftME Invocations_H.invocation.InvokeTCB (decodeTCBInvocation label args cp slot extraCaps) else if cp = capability.DomainCap then liftME (uncurry Invocations_H.invocation.InvokeDomain) (decodeDomainInvocation label args extraCaps) else if isCNodeCap cp then liftME Invocations_H.invocation.InvokeCNode (decodeCNodeInvocation label args cp (map fst extraCaps)) else if isUntypedCap cp then liftME Invocations_H.invocation.InvokeUntyped (decodeUntypedInvocation label args slot cp (map fst extraCaps)) else if isIRQControlCap cp then liftME Invocations_H.invocation.InvokeIRQControl (global.decodeIRQControlInvocation label args slot (map fst extraCaps)) else if isIRQHandlerCap cp then liftME Invocations_H.invocation.InvokeIRQHandler (decodeIRQHandlerInvocation label (capIRQ cp) extraCaps) else if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (Guard DontReach {} SKIP)
 3. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and K (isUntypedCap cp) and cte_wp_at' (\<lambda>cte. cteCap cte = cp) slot and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isUntypedCap cp \<longrightarrow> (isIRQControlCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isIRQControlCap cp \<longrightarrow> (isIRQHandlerCap cp \<longrightarrow> ?Q18229 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> ?R18228 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> {s. (isIRQControlCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (srcSlot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = slota\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isIRQControlCap cp \<longrightarrow> s \<in> {s. (isIRQHandlerCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'18261 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> s \<in> ?T18230 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true False + one_on_true (isArchObjectCap cp) + one_on_true False + one_on_true False + one_on_true False + one_on_true False + one_on_true False + one_on_true False + one_on_true False + one_on_true False + one_on_true False + one_on_true False = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; \<not> isIRQControlCap cp; \<not> isIRQHandlerCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18228 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall)) (?T18230 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap)) [SKIP] ((if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (Guard DontReach {} SKIP)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and K (isUntypedCap cp) and cte_wp_at' (\<lambda>cte. cteCap cte = cp) slot and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isUntypedCap cp \<longrightarrow> (isIRQControlCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isIRQControlCap cp \<longrightarrow> (isIRQHandlerCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap (capIRQ cp)) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> ?R18228 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s))))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> {s. (isIRQControlCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (srcSlot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = slota\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isIRQControlCap cp \<longrightarrow> s \<in> {s. (isIRQHandlerCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. v) (invLabel_'_update (\<lambda>_. invLabel) s) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (capIRQ cp)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> s \<in> ?T18230 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va)})})})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla ret__unsigned_long ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; one_on_true False + one_on_true (isArchObjectCap cp) + one_on_true False + one_on_true False + one_on_true False + one_on_true False + one_on_true False + one_on_true False + one_on_true False + one_on_true False + one_on_true False + one_on_true False = Suc 0; \<not> isArchCap (\<lambda>_. True) cp; ret__unsigned = cap_get_tag cap; cp \<noteq> capability.NullCap; \<not> isZombie cp; \<not> isEndpointCap cp; \<not> isNotificationCap cp; \<not> isReplyCap cp; \<not> isThreadCap cp; cp \<noteq> capability.DomainCap; \<not> isCNodeCap cp; \<not> isUntypedCap cp; \<not> isIRQControlCap cp; \<not> isIRQHandlerCap cp\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>_. True) UNIV [SKIP] ((if isArchObjectCap cp then liftME Invocations_H.invocation.InvokeArchObject (Arch.decodeInvocation label args cptr slot (capCap cp) extraCaps) else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall id) (Guard DontReach {} SKIP)
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and K (isUntypedCap cp) and cte_wp_at' (\<lambda>cte. cteCap cte = cp) slot and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isUntypedCap cp \<longrightarrow> (isIRQControlCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isIRQControlCap cp \<longrightarrow> (isIRQHandlerCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap (capIRQ cp)) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> True))))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> {s. (isIRQControlCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (srcSlot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = slota\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isIRQControlCap cp \<longrightarrow> s \<in> {s. (isIRQHandlerCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. v) (invLabel_'_update (\<lambda>_. invLabel) s) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (capIRQ cp)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> s \<in> UNIV)})})})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (1 subgoal):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and K (isUntypedCap cp) and cte_wp_at' (\<lambda>cte. cteCap cte = cp) slot and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isUntypedCap cp \<longrightarrow> (isIRQControlCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isIRQControlCap cp \<longrightarrow> (isIRQHandlerCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap (capIRQ cp)) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> True))))))))))))) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> {s. (isIRQControlCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (srcSlot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = slota\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isIRQControlCap cp \<longrightarrow> s \<in> {s. (isIRQHandlerCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. v) (invLabel_'_update (\<lambda>_. invLabel) s) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (capIRQ cp)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> s \<in> UNIV)})})})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (isArchCap (\<lambda>_. True) cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) (capability.ArchObjectCap (capCap cp)) \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer and valid_objs') s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> (cp = capability.NullCap \<longrightarrow> True) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> (isZombie cp \<longrightarrow> True) \<and> (\<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capEPCanSend cp \<longrightarrow> True) and (\<lambda>s. capEPCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> ((thread = ksCurThread a \<longrightarrow> simple' Structures_H.thread_state.Restart \<and> tcb_at' (ksCurThread a) a) \<and> (thread \<noteq> ksCurThread a \<longrightarrow> st_tcb_at' simple' (ksCurThread a) a)) \<and> ep_at' (capEPPtr cp) a \<and> sch_act_sane a \<and> (\<forall>x xa. (runnable' Structures_H.thread_state.Restart \<or> ksCurThread a \<noteq> thread) \<and> ksCurThread a \<notin> set (ksReadyQueues a (x, xa))))) s)) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> capNtfnCanSend cp \<longrightarrow> True) and (\<lambda>s. capNtfnCanSend cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> True \<and> True)) s)) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. \<not> \<not> capReplyMaster cp \<longrightarrow> True) and (\<lambda>s. \<not> capReplyMaster cp \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. ksCurThread a = thread \<and> (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> tcb_at' (capTCBPtr cp) a \<and> ((thread = thread \<longrightarrow> active' Structures_H.thread_state.Restart \<and> tcb_at' thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' active' thread a)) \<and> sch_act_simple a \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot a \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot a)) s)) s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and excaps_in_mem extraCaps \<circ> ctes_of and tcb_at' (capTCBPtr cp) and ex_nonz_cap_to' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s) \<and> (\<not> isThreadCap cp \<longrightarrow> (cp = capability.DomainCap \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> (isCNodeCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and valid_cap' cp and K (isUntypedCap cp) and cte_wp_at' (\<lambda>cte. cteCap cte = cp) slot and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isUntypedCap cp \<longrightarrow> (isIRQControlCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s) \<and> (\<not> isIRQControlCap cp \<longrightarrow> (isIRQHandlerCap cp \<longrightarrow> (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap (capIRQ cp)) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> True))))))))))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> {s. (isIRQControlCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (srcSlot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = slota\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isIRQControlCap cp \<longrightarrow> s \<in> {s. (isIRQHandlerCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. v) (invLabel_'_update (\<lambda>_. invLabel) s) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (capIRQ cp)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> s \<in> UNIV)})})})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>cap length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation cp cap; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) cp \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> (isArchCap (\<lambda>_. True) cp \<longrightarrow> cte_wp_at' (\<lambda>a. capability.ArchObjectCap (capCap cp) = cteCap a) slot s \<and> valid_objs' s) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> cp \<noteq> capability.NullCap \<longrightarrow> \<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> capEPCanSend cp \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> ep_at' (capEPPtr cp) s) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> capNtfnCanSend cp \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> weak_sch_act_wf (ksSchedulerAction s) s) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> \<not> capReplyMaster cp \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> tcb_at' (capTCBPtr cp) s \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) slot s \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap \<or> isReplyCap (cteCap a)) slot s) \<and> (\<not> isReplyCap cp \<longrightarrow> (isThreadCap cp \<longrightarrow> cte_wp_at' (\<lambda>_. True) slot s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s) \<and> (\<not> isThreadCap cp \<longrightarrow> cp \<noteq> capability.DomainCap \<longrightarrow> \<not> isCNodeCap cp \<longrightarrow> (isUntypedCap cp \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cp) slot s) \<and> (\<not> isUntypedCap cp \<longrightarrow> (isIRQControlCap cp \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s) \<and> (\<not> isIRQControlCap cp \<longrightarrow> isIRQHandlerCap cp \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap (capIRQ cp)) slot s))))))))
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> {s. (isIRQControlCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (srcSlot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = slota\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isIRQControlCap cp \<longrightarrow> s \<in> {s. (isIRQHandlerCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. v) (invLabel_'_update (\<lambda>_. invLabel) s) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (capIRQ cp)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> s \<in> UNIV)})})})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>cap length___unsigned_long s s' cte v0. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.IRQHandlerCap v0) cap; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. capAligned (fst v) \<and> (case fst v of capability.ThreadCap r \<Rightarrow> tcb_at' r s | capability.NotificationCap r badge x y \<Rightarrow> ntfn_at' r s | capability.IRQHandlerCap irq \<Rightarrow> irq \<le> local.maxIRQ | capability.EndpointCap r badge x y z t \<Rightarrow> ep_at' r s | capability.Zombie r b n \<Rightarrow> n \<le> zombieCTEs b \<and> zBits b < word_bits \<and> (case b of ZombieTCB \<Rightarrow> tcb_at' r s | ZombieCNode n \<Rightarrow> n \<noteq> 0 \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask n)) s)) | capability.ArchObjectCap (arch_capability.ASIDPoolCap pool asid) \<Rightarrow> asid_pool_at' pool s \<and> is_aligned asid local.asid_low_bits \<and> asid \<le> 2 ^ local.asid_bits - 1 | capability.ArchObjectCap arch_capability.ASIDControlCap \<Rightarrow> True | capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz mapdata) \<Rightarrow> ref \<noteq> 0 \<and> (\<forall>p<2 ^ (pageBitsForSize sz - pageBits). typ_at' (if d then UserDataDeviceT else UserDataT) (ref + p * 2 ^ pageBits) s) \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> vmsz_aligned' ref sz \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageTableCap ref mapdata) \<Rightarrow> page_table_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1 \<and> ref < pptrBase) | capability.ArchObjectCap (arch_capability.PageDirectoryCap ref mapdata) \<Rightarrow> page_directory_at' ref s \<and> (case mapdata of None \<Rightarrow> True | Some asid \<Rightarrow> 0 < asid \<and> asid \<le> 2 ^ local.asid_bits - 1) | capability.ReplyCap r m x \<Rightarrow> tcb_at' r s | capability.UntypedCap d r n f \<Rightarrow> valid_untyped' d r n f s \<and> r \<noteq> 0 \<and> minUntypedSizeBits \<le> n \<and> n \<le> maxUntypedSizeBits \<and> f \<le> 2 ^ n \<and> is_aligned (word_of_nat f) minUntypedSizeBits | capability.CNodeCap r bits guard guard_sz \<Rightarrow> bits \<noteq> 0 \<and> bits + guard_sz \<le> word_bits \<and> guard && mask guard_sz = guard \<and> (\<forall>addr. real_cte_at' (r + 2 ^ cteSizeBits * (addr && mask bits)) s) | _ \<Rightarrow> True) \<and> (\<exists>cte. ctes_of s (snd v) = Some cte); \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; capAligned (capability.IRQHandlerCap v0); v0 \<le> local.maxIRQ; ctes_of s slot = Some cte; cp = capability.IRQHandlerCap v0; cteCap cte = capability.IRQHandlerCap v0\<rbrakk> \<Longrightarrow> \<exists>slot cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.IRQHandlerCap v0
 2. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> {s. (isIRQControlCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (srcSlot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = slota\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isIRQControlCap cp \<longrightarrow> s \<in> {s. (isIRQHandlerCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. v) (invLabel_'_update (\<lambda>_. invLabel) s) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (capIRQ cp)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> s \<in> UNIV)})})})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (1 subgoal):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and (\<lambda>s. \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' ((=) cp \<circ> cteCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) and (\<lambda>s. \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) and sysargs_rel args buffer) s; s' \<in> \<lbrace>\<acute>call = from_bool isCall\<rbrace> \<inter> \<lbrace>\<acute>block = from_bool isBlocking\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (cptr_'_update (\<lambda>_. capIndex) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>))))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (capCap cp)) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. (cp = capability.NullCap \<longrightarrow> s \<in> UNIV) \<and> (cp \<noteq> capability.NullCap \<longrightarrow> s \<in> {s. (isZombie cp \<longrightarrow> s \<in> UNIV) \<and> (\<not> isZombie cp \<longrightarrow> s \<in> {s. (isEndpointCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capCanSend_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (\<not> isEndpointCap cp \<longrightarrow> s \<in> {s. (isNotificationCap cp \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>vb = 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t = ?message17087 buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla v va vb s t) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}) \<and> (\<not> isNotificationCap cp \<longrightarrow> s \<in> {s. (isReplyCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capReplyMaster_CL (cap_reply_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>True\<rbrace> \<inter> {s. (s \<in> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (s \<notin> \<lbrace>v \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> \<lbrace>((\<exists>rv. \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> va = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrace>)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap}) \<and> (\<not> isReplyCap cp \<longrightarrow> s \<in> {s. (isThreadCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (slot_'_update (\<lambda>_. slota) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isThreadCap cp \<longrightarrow> s \<in> {s. (cp = capability.DomainCap \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (cp \<noteq> capability.DomainCap \<longrightarrow> s \<in> {s. (isCNodeCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (cap_'_update (\<lambda>_. cap) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isCNodeCap cp \<longrightarrow> s \<in> {s. (isUntypedCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (call_'_update (\<lambda>_. calla) (cap_'_update (\<lambda>_. cap) (slot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)))) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = slota\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>call = calla\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isUntypedCap cp \<longrightarrow> s \<in> {s. (isIRQControlCap cp \<longrightarrow> s \<in> {s. buffer_'_update (\<lambda>_. buffera) (srcSlot_'_update (\<lambda>_. slota) (s\<lparr>invLabel_' := invLabel, length___unsigned_long_' := length___unsigned_long\<rparr>)) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = slota\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace> \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>}) \<and> (\<not> isIRQControlCap cp \<longrightarrow> s \<in> {s. (isIRQHandlerCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capIRQ_CL (cap_irq_handler_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. irq_'_update (\<lambda>_. v) (invLabel_'_update (\<lambda>_. invLabel) s) \<in> UNIV \<inter> \<lbrace>\<acute>invLabel = invLabel\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (capIRQ cp)\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap}) \<and> (\<not> isIRQHandlerCap cp \<longrightarrow> s \<in> UNIV)})})})})})})})})})})}})}}
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (1 subgoal):
 1. \<And>buffera cap current_extra_caps slota capIndex length___unsigned_long invLabel block calla s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; ccap_relation cp cap; current_extra_caps = extraCaps'; slota = cte_Ptr slot; capIndex = cptr; unat length___unsigned_long = length args; invLabel = label; block = from_bool isBlocking; calla = from_bool isCall; (s, s') \<in> rf_sr; invs' s \<and> ksCurThread s = thread \<and> ct_active' s \<and> sch_act_simple s \<and> valid_cap' cp s \<and> (\<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s) \<and> excaps_in_mem extraCaps (ctes_of s) \<and> cte_wp_at' ((=) cp \<circ> cteCap) slot s \<and> (\<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) \<and> (\<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) \<and> (\<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s) \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) \<and> sysargs_rel args buffer s; call_' s' = from_bool isCall \<and> block_' s' = from_bool isBlocking \<and> current_extra_caps_' (globals s') = extraCaps'\<rbrakk> \<Longrightarrow> (isArchCap (\<lambda>_. True) cp \<longrightarrow> ccap_relation (capability.ArchObjectCap (capCap cp)) cap) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> cp \<noteq> capability.NullCap \<longrightarrow> \<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> (capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift cap) \<noteq> 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr thread \<and> capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (from_bool (isArchCap_tag (cap_get_tag cap))) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := from_bool (isArchCap_tag (cap_get_tag cap)), ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t = ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (from_bool (isArchCap_tag (cap_get_tag cap))) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := from_bool (isArchCap_tag (cap_get_tag cap)), ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> (capReplyMaster_CL (cap_reply_cap_lift cap) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>rv. ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr rv) \<longrightarrow> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap) \<and> (\<not> isReplyCap cp \<longrightarrow> \<not> isThreadCap cp \<longrightarrow> cp \<noteq> capability.DomainCap \<longrightarrow> \<not> isCNodeCap cp \<longrightarrow> \<not> isUntypedCap cp \<longrightarrow> \<not> isIRQControlCap cp \<longrightarrow> isIRQHandlerCap cp \<longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) = UCAST(10 \<rightarrow> 32) (capIRQ cp) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap))))
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (1 subgoal):
 1. \<And>cap length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation cp cap; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' cp s; \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) cp \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> (isArchCap (\<lambda>_. True) cp \<longrightarrow> ccap_relation (capability.ArchObjectCap (capCap cp)) cap) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> cp \<noteq> capability.NullCap \<longrightarrow> \<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift cap) \<noteq> 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t = ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t)) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift cap) = 0 \<longrightarrow> 2 && mask 4 = 2 \<and> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> (\<not> isReplyCap cp \<longrightarrow> \<not> isThreadCap cp \<longrightarrow> cp \<noteq> capability.DomainCap \<longrightarrow> \<not> isCNodeCap cp \<longrightarrow> \<not> isUntypedCap cp \<longrightarrow> \<not> isIRQControlCap cp \<longrightarrow> isIRQHandlerCap cp \<longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) = UCAST(10 \<rightarrow> 32) (capIRQ cp)))))
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (1 subgoal):
 1. \<And>cap length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation cp cap; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' cp s; \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) cp \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; word_of_nat (length args) = length___unsigned_long\<rbrakk> \<Longrightarrow> (isArchCap (\<lambda>_. True) cp \<longrightarrow> ccap_relation (capability.ArchObjectCap (capCap cp)) cap) \<and> (\<not> isArchCap (\<lambda>_. True) cp \<longrightarrow> cp \<noteq> capability.NullCap \<longrightarrow> \<not> isZombie cp \<longrightarrow> (isEndpointCap cp \<longrightarrow> capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift cap) \<noteq> 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t = ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t)) \<and> (\<not> isNotificationCap cp \<longrightarrow> (isReplyCap cp \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift cap) = 0 \<longrightarrow> 2 && mask 4 = 2 \<and> tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant cp)) \<and> (\<not> isReplyCap cp \<longrightarrow> \<not> isThreadCap cp \<longrightarrow> cp \<noteq> capability.DomainCap \<longrightarrow> \<not> isCNodeCap cp \<longrightarrow> \<not> isUntypedCap cp \<longrightarrow> \<not> isIRQControlCap cp \<longrightarrow> isIRQHandlerCap cp \<longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) = UCAST(10 \<rightarrow> 32) (capIRQ cp)))))
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (1 subgoal):
 1. \<And>cap length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation cp cap; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' cp s; \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) cp \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; word_of_nat (length args) = length___unsigned_long\<rbrakk> \<Longrightarrow> (isArchCap_tag (cap_get_tag cap) \<longrightarrow> ccap_relation (capability.ArchObjectCap (capCap cp)) cap) \<and> (\<not> isArchCap_tag (cap_get_tag cap) \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> (cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift cap) \<noteq> 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t = ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t)) \<and> (cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift cap) = 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<and> (cp \<noteq> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))) \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> cp \<noteq> capability.DomainCap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) = UCAST(10 \<rightarrow> 32) (capIRQ cp)))))
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>cap length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation cp cap; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' cp s; \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) cp \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; word_of_nat (length args) = length___unsigned_long\<rbrakk> \<Longrightarrow> isArchCap_tag (cap_get_tag cap) \<longrightarrow> ccap_relation (capability.ArchObjectCap (capCap cp)) cap
 2. \<And>cap length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation cp cap; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' cp s; \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) cp \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; word_of_nat (length args) = length___unsigned_long\<rbrakk> \<Longrightarrow> \<not> isArchCap_tag (cap_get_tag cap) \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> (cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift cap) \<noteq> 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t = ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t)) \<and> (cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift cap) = 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<and> (cp \<noteq> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))) \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> cp \<noteq> capability.DomainCap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) = UCAST(10 \<rightarrow> 32) (capIRQ cp))))
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>cap length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation cp cap; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' cp s; \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) cp \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; word_of_nat (length args) = length___unsigned_long\<rbrakk> \<Longrightarrow> isArchCap (\<lambda>_. True) cp \<longrightarrow> ccap_relation (capability.ArchObjectCap (capCap cp)) cap
 2. \<And>cap length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation cp cap; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' cp s; \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) cp \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; word_of_nat (length args) = length___unsigned_long\<rbrakk> \<Longrightarrow> \<not> isArchCap_tag (cap_get_tag cap) \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> (cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift cap) \<noteq> 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t = ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t)) \<and> (cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift cap) = 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<and> (cp \<noteq> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))) \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> cp \<noteq> capability.DomainCap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) = UCAST(10 \<rightarrow> 32) (capIRQ cp))))
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (1 subgoal):
 1. \<And>cap length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation cp cap; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' cp s; \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) cp \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; word_of_nat (length args) = length___unsigned_long\<rbrakk> \<Longrightarrow> \<not> isArchCap_tag (cap_get_tag cap) \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> (cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift cap) \<noteq> 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t = ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t)) \<and> (cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift cap) = 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<and> (cp \<noteq> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))) \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> cp \<noteq> capability.DomainCap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) = UCAST(10 \<rightarrow> 32) (capIRQ cp))))
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (1 subgoal):
 1. \<And>cap length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation cp cap; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' cp s; \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) cp \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; word_of_nat (length args) = length___unsigned_long; isIRQHandlerCap cp \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) && mask 10 = capIRQ_CL (cap_irq_handler_cap_lift cap)\<rbrakk> \<Longrightarrow> \<not> isArchCap_tag (cap_get_tag cap) \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<longrightarrow> (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> (cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift cap) \<noteq> 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t = ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t)) \<and> (cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift cap) = 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<and> (cp \<noteq> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))) \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> cp \<noteq> capability.DomainCap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) = UCAST(10 \<rightarrow> 32) (capIRQ cp))))
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (1 subgoal):
 1. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation cp cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' cp s; \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) cp \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; isIRQHandlerCap cp \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) && mask 10 = capIRQ_CL (cap_irq_handler_cap_lift cap); \<not> isArchCap_tag (cap_get_tag cap); cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap\<rbrakk> \<Longrightarrow> (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> (cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift cap) \<noteq> 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t = ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t)) \<and> (cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift cap) = 0 \<longrightarrow> 2 && mask 4 = 2 \<and> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<and> (cp \<noteq> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))) \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> cp \<noteq> capability.DomainCap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) = UCAST(10 \<rightarrow> 32) (capIRQ cp))))
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (1 subgoal):
 1. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation cp cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' cp s; \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) cp \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; isIRQHandlerCap cp \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) && mask 10 = capIRQ_CL (cap_irq_handler_cap_lift cap); \<not> isArchCap_tag (cap_get_tag cap); cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_zombie_cap\<rbrakk> \<Longrightarrow> (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0 \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> (cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift cap) \<noteq> 0 \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t = ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t)) \<and> (cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift cap) = 0 \<longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<and> (cp \<noteq> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))) \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> cp \<noteq> capability.DomainCap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) = UCAST(10 \<rightarrow> 32) (capIRQ cp))))
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (1 subgoal):
 1. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation cp cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' cp s; \<forall>x\<in>zobj_refs' cp. ex_nonz_cap_to' x s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) cp \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; isIRQHandlerCap cp \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) && mask 10 = capIRQ_CL (cap_irq_handler_cap_lift cap); \<not> isArchCap (\<lambda>_. True) cp; cp \<noteq> capability.NullCap; \<not> isZombie cp\<rbrakk> \<Longrightarrow> (isEndpointCap cp \<longrightarrow> capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0 \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge cp \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant cp) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply cp) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr cp \<and> capEPBadge cp && mask 28 = capEPBadge cp) \<and> (\<not> isEndpointCap cp \<longrightarrow> (isNotificationCap cp \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift cap) \<noteq> 0 \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift cap) = capNtfnPtr cp \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = capNtfnBadge cp \<and> (\<forall>t. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t = ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t)) \<and> (\<not> isNotificationCap cp \<longrightarrow> (cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))) \<longrightarrow> capReplyMaster_CL (cap_reply_cap_lift cap) = 0 \<longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<and> (cp \<noteq> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) (to_bool (capReplyMaster_CL (cap_reply_cap_lift cap))) (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))) \<longrightarrow> \<not> isThreadCap cp \<longrightarrow> cp \<noteq> capability.DomainCap \<longrightarrow> \<not> isCNodeCap cp \<longrightarrow> \<not> isUntypedCap cp \<longrightarrow> \<not> isIRQControlCap cp \<longrightarrow> isIRQHandlerCap cp \<longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) = UCAST(10 \<rightarrow> 32) (capIRQ cp))))
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.NotificationCap x31 x32 x33 x34) s; ex_nonz_cap_to' x31 s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.NotificationCap x31 x32 x33 x34) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.NotificationCap x31 x32 x33 x34; capNtfnCanSend_CL (cap_notification_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift cap) = x31 \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = x32 \<and> (\<forall>t. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t = ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t)
 2. \<And>cap s s' x4. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.IRQHandlerCap x4) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.IRQHandlerCap x4) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.IRQHandlerCap x4) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; capIRQ_CL (cap_irq_handler_cap_lift cap) && mask 10 = capIRQ_CL (cap_irq_handler_cap_lift cap); cp = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) = UCAST(10 \<rightarrow> 32) x4
 3. \<And>cap s s' x51 x52 x53 x54 x55 x56. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) s; ex_nonz_cap_to' x51 s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.EndpointCap x51 x52 x53 x54 x55 x56; capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = x52 \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool x55 \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool x56 \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = x51 \<and> x52 && mask 28 = x52
 4. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))); capReplyMaster_CL (cap_reply_cap_lift cap) = 0\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.NotificationCap x31 x32 x33 x34) s; ex_nonz_cap_to' x31 s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.NotificationCap x31 x32 x33 x34) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.NotificationCap x31 x32 x33 x34; capNtfnCanSend_CL (cap_notification_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; capability.NotificationCap x31 x32 x33 x34 = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift cap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift cap)))\<rbrakk> \<Longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift cap) = x31 \<and> capNtfnBadge_CL (cap_notification_cap_lift cap) = x32 \<and> (\<forall>t. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t = ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>) t)
 2. \<And>cap s s' x4. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.IRQHandlerCap x4) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.IRQHandlerCap x4) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.IRQHandlerCap x4) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; capIRQ_CL (cap_irq_handler_cap_lift cap) && mask 10 = capIRQ_CL (cap_irq_handler_cap_lift cap); cp = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) = UCAST(10 \<rightarrow> 32) x4
 3. \<And>cap s s' x51 x52 x53 x54 x55 x56. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) s; ex_nonz_cap_to' x51 s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.EndpointCap x51 x52 x53 x54 x55 x56; capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = x52 \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool x55 \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool x56 \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = x51 \<and> x52 && mask 28 = x52
 4. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))); capReplyMaster_CL (cap_reply_cap_lift cap) = 0\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))
flex-flex pairs:
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' x4. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.IRQHandlerCap x4) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.IRQHandlerCap x4) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.IRQHandlerCap x4) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; capIRQ_CL (cap_irq_handler_cap_lift cap) && mask 10 = capIRQ_CL (cap_irq_handler_cap_lift cap); cp = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) = UCAST(10 \<rightarrow> 32) x4
 2. \<And>cap s s' x51 x52 x53 x54 x55 x56. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) s; ex_nonz_cap_to' x51 s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.EndpointCap x51 x52 x53 x54 x55 x56; capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = x52 \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool x55 \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool x56 \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = x51 \<and> x52 && mask 28 = x52
 3. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))); capReplyMaster_CL (cap_reply_cap_lift cap) = 0\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))
flex-flex pairs:
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t\<lparr>ksMachineState := ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)\<lparr>irq_state := ?f18749 cap s s' x31 x32 x33 x34 t (irq_state (ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)))\<rparr>\<rparr>)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' x4. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.IRQHandlerCap x4) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.IRQHandlerCap x4) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; capIRQ_CL (cap_irq_handler_cap_lift cap) && mask 10 = capIRQ_CL (cap_irq_handler_cap_lift cap); cp = capability.IRQHandlerCap x4; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap; capability.IRQHandlerCap x4 = capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL (cap_irq_handler_cap_lift cap)))\<rbrakk> \<Longrightarrow> capIRQ_CL (cap_irq_handler_cap_lift cap) = UCAST(10 \<rightarrow> 32) x4
 2. \<And>cap s s' x51 x52 x53 x54 x55 x56. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) s; ex_nonz_cap_to' x51 s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.EndpointCap x51 x52 x53 x54 x55 x56; capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = x52 \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool x55 \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool x56 \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = x51 \<and> x52 && mask 28 = x52
 3. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))); capReplyMaster_CL (cap_reply_cap_lift cap) = 0\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))
flex-flex pairs:
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t\<lparr>ksMachineState := ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)\<lparr>irq_state := ?f18749 cap s s' x31 x32 x33 x34 t (irq_state (ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)))\<rparr>\<rparr>)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>cap s s' x51 x52 x53 x54 x55 x56. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) s; ex_nonz_cap_to' x51 s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.EndpointCap x51 x52 x53 x54 x55 x56; capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = x52 \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool x55 \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool x56 \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = x51 \<and> x52 && mask 28 = x52
 2. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))); capReplyMaster_CL (cap_reply_cap_lift cap) = 0\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))
flex-flex pairs:
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t\<lparr>ksMachineState := ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)\<lparr>irq_state := ?f18749 cap s s' x31 x32 x33 x34 t (irq_state (ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)))\<rparr>\<rparr>)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' x51 x52 x53 x54 x55 x56. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) s; ex_nonz_cap_to' x51 s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.EndpointCap x51 x52 x53 x54 x55 x56; capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap
 2. \<And>cap s s' x51 x52 x53 x54 x55 x56. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) s; ex_nonz_cap_to' x51 s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.EndpointCap x51 x52 x53 x54 x55 x56; capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0; capCanSend_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanSend (capability.EndpointCap x51 x52 x53 x54 x55 x56)) \<and> capCanReceive_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanReceive (capability.EndpointCap x51 x52 x53 x54 x55 x56)) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant (capability.EndpointCap x51 x52 x53 x54 x55 x56)) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply (capability.EndpointCap x51 x52 x53 x54 x55 x56))\<rbrakk> \<Longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = x52 \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool x55 \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool x56 \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = x51 \<and> x52 && mask 28 = x52
 3. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))); capReplyMaster_CL (cap_reply_cap_lift cap) = 0\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))
flex-flex pairs:
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t\<lparr>ksMachineState := ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)\<lparr>irq_state := ?f18749 cap s s' x31 x32 x33 x34 t (irq_state (ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)))\<rparr>\<rparr>)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>cap s s' x51 x52 x53 x54 x55 x56. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56) s; ex_nonz_cap_to' x51 s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.EndpointCap x51 x52 x53 x54 x55 x56; capCanSend_CL (cap_endpoint_cap_lift cap) \<noteq> 0; capCanSend_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanSend (capability.EndpointCap x51 x52 x53 x54 x55 x56)) \<and> capCanReceive_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanReceive (capability.EndpointCap x51 x52 x53 x54 x55 x56)) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = capEPPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> capEPBadge_CL (cap_endpoint_cap_lift cap) = capEPBadge (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrant (capability.EndpointCap x51 x52 x53 x54 x55 x56)) \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool (capEPCanGrantReply (capability.EndpointCap x51 x52 x53 x54 x55 x56))\<rbrakk> \<Longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) = x52 \<and> capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool x55 \<and> capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool x56 \<and> capEPPtr_CL (cap_endpoint_cap_lift cap) = x51 \<and> x52 && mask 28 = x52
 2. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))); capReplyMaster_CL (cap_reply_cap_lift cap) = 0\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))
flex-flex pairs:
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t\<lparr>ksMachineState := ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)\<lparr>irq_state := ?f18749 cap s s' x31 x32 x33 x34 t (irq_state (ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)))\<rparr>\<rparr>)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>cap s s' x53 x54 x55 x56. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap)) (capEPBadge_CL (cap_endpoint_cap_lift cap)) True x54 x55 x56) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap)) (capEPBadge_CL (cap_endpoint_cap_lift cap)) True x54 x55 x56) s; ex_nonz_cap_to' (capEPPtr_CL (cap_endpoint_cap_lift cap)) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap)) (capEPBadge_CL (cap_endpoint_cap_lift cap)) True x54 x55 x56) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap)) (capEPBadge_CL (cap_endpoint_cap_lift cap)) True x54 x55 x56; x53; capCanSend_CL (cap_endpoint_cap_lift cap) = SCAST(32 signed \<rightarrow> 32) true; capCanReceive_CL (cap_endpoint_cap_lift cap) = from_bool x54; capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool x55; capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool x56\<rbrakk> \<Longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap) && mask 28 = capEPBadge_CL (cap_endpoint_cap_lift cap)
 2. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))); capReplyMaster_CL (cap_reply_cap_lift cap) = 0\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))
flex-flex pairs:
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t\<lparr>ksMachineState := ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)\<lparr>irq_state := ?f18749 cap s s' x31 x32 x33 x34 t (irq_state (ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)))\<rparr>\<rparr>)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>cap s s' x53 x54 x55 x56. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap)) (capEPBadge_CL (cap_endpoint_cap_lift cap)) True x54 x55 x56) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap)) (capEPBadge_CL (cap_endpoint_cap_lift cap)) True x54 x55 x56) s; ex_nonz_cap_to' (capEPPtr_CL (cap_endpoint_cap_lift cap)) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap)) (capEPBadge_CL (cap_endpoint_cap_lift cap)) True x54 x55 x56) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap)) (capEPBadge_CL (cap_endpoint_cap_lift cap)) True x54 x55 x56; x53; capCanSend_CL (cap_endpoint_cap_lift cap) = SCAST(32 signed \<rightarrow> 32) true; capCanReceive_CL (cap_endpoint_cap_lift cap) = from_bool x54; capCanGrant_CL (cap_endpoint_cap_lift cap) = from_bool x55; capCanGrantReply_CL (cap_endpoint_cap_lift cap) = from_bool x56\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap
 2. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))); capReplyMaster_CL (cap_reply_cap_lift cap) = 0\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))
flex-flex pairs:
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t\<lparr>ksMachineState := ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)\<lparr>irq_state := ?f18749 cap s s' x31 x32 x33 x34 t (irq_state (ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)))\<rparr>\<rparr>)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (1 subgoal):
 1. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))); capReplyMaster_CL (cap_reply_cap_lift cap) = 0\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))
flex-flex pairs:
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t\<lparr>ksMachineState := ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)\<lparr>irq_state := ?f18749 cap s s' x31 x32 x33 x34 t (irq_state (ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)))\<rparr>\<rparr>)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (2 subgoals):
 1. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))); capReplyMaster_CL (cap_reply_cap_lift cap) = 0\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_reply_cap
 2. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))); capReplyMaster_CL (cap_reply_cap_lift cap) = 0; capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))))) \<and> capReplyMaster_CL (cap_reply_cap_lift cap) = from_bool (capReplyMaster (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))))) \<and> cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap) = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))))))\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))
flex-flex pairs:
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t\<lparr>ksMachineState := ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)\<lparr>irq_state := ?f18749 cap s s' x31 x32 x33 x34 t (irq_state (ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)))\<rparr>\<rparr>)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal (1 subgoal):
 1. \<And>cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; ccap_relation (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) cap; unat (word_of_nat (length args)) = length args; (s, s') \<in> rf_sr; invs' s; call_' s' = from_bool isCall; thread = ksCurThread s; block_' s' = from_bool isBlocking; extraCaps' = current_extra_caps_' (globals s'); ct_active' s; sch_act_simple s; valid_cap' (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' ((=) (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))) \<circ> cteCap) slot s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. \<forall>y\<in>zobj_refs' (fst v). ex_nonz_cap_to' y s; \<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b)); sysargs_rel args buffer s; cp = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))); capReplyMaster_CL (cap_reply_cap_lift cap) = 0; capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (capReplyCanGrant (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))))) \<and> capReplyMaster_CL (cap_reply_cap_lift cap) = from_bool (capReplyMaster (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))))) \<and> cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap) = ptr_val (tcb_ptr_to_ctcb_ptr (capTCBPtr (capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift cap)))) False (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap))))))\<rbrakk> \<Longrightarrow> capReplyCanGrant_CL (cap_reply_cap_lift cap) = from_bool (to_bool (capReplyCanGrant_CL (cap_reply_cap_lift cap)))
flex-flex pairs:
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t\<lparr>ksMachineState := ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)\<lparr>irq_state := ?f18749 cap s s' x31 x32 x33 x34 t (irq_state (ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)))\<rparr>\<rparr>)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) proof (prove)
goal:
No subgoals!
flex-flex pairs:
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message17087 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap s s' x31 x32 x33 x34 t. ?P18749 cap s s' x31 x32 x33 x34 t (typ_at' (?T18749 cap s s' x31 x32 x33 x34 t) (?p18749 cap s s' x31 x32 x33 x34 t) (?s18749 cap s s' x31 x32 x33 x34 t\<lparr>ksMachineState := ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)\<lparr>irq_state := ?f18749 cap s s' x31 x32 x33 x34 t (irq_state (ksMachineState (?s18749 cap s s' x31 x32 x33 x34 t)))\<rparr>\<rparr>)) \<equiv>\<^sup>? \<lambda>cap s s' x31 x32 x33 x34. ?message_'17088 (option_to_ptr buffer) cap (current_extra_caps_' (globals s')) (cte_Ptr slot) cptr (word_of_nat (length args)) label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) cap_notification_cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (s'\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) false, ret__unsigned_' := capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rparr>)
\<lambda>cap length___unsigned_long. ?message_'17088 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message_'16919 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) (badge_'_update (\<lambda>_. capNtfnBadge_CL (cap_notification_cap_lift cap)) (ntfn_'_update (\<lambda>_. ntfn_Ptr (capNtfnPtr_CL (cap_notification_cap_lift cap))) (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capNtfnPtr_CL (cap_notification_cap_lift cap), unsigned_eret_2_' := capNtfnBadge_CL (cap_notification_cap_lift cap)\<rparr>)))
\<lambda>cap length___unsigned_long. ?message17087 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap length___unsigned_long s t. ?message16924 (option_to_ptr buffer) cap extraCaps' (cte_Ptr slot) cptr length___unsigned_long label (from_bool isBlocking) (from_bool isCall) (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag cap) (capNtfnCanSend_CL (cap_notification_cap_lift cap)) () (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap))