theory Syscall_C

lemma sendFaultIPC_ccorres:
  "ccorres  (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
      (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and
       (\<lambda>s. \<forall>p. tptr \<notin> set (ksReadyQueues s p)))
      (UNIV \<inter> {s. (cfault_rel (Some fault) (seL4_Fault_lift(current_fault_' (globals s)))
                       (lookup_fault_lift(current_lookup_fault_' (globals s))))}
            \<inter> {s. tptr_' s = tcb_ptr_to_ctcb_ptr tptr})
      [] (sendFaultIPC tptr fault)
         (Call sendFaultIPC_'proc)" supply if_cong[cong] option.case_cong[cong] supply Collect_const[simp del] apply (cinit lift: tptr_' cong: call_ignore_cong) apply (simp add: liftE_bindE del:Collect_const cong:call_ignore_cong) apply (rule ccorres_symb_exec_r) apply (rule ccorres_split_nothrow) apply (rule threadGet_tcbFaultHandler_ccorres) apply ceqv apply (rule_tac  xf'=lu_ret___struct_lookupCap_ret_C_'
                in ccorres_split_nothrow_callE) apply (rule capFaultOnFailure_ccorres) apply (rule lookupCap_ccorres) apply simp+ apply ceqv apply (rename_tac epcap epcap') apply clarsimp apply ccorres_rewrite apply csymbr apply (simp add: cap_case_EndpointCap) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule_tac val="from_bool (isEndpointCap epcap \<and> capEPCanSend epcap
                                          \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))"
                   and xf'=ret__int_' and R=\<top> and R'=UNIV in ccorres_symb_exec_r_known_rv) apply (rule conseqPre, vcg) apply (fastforce simp: from_bool_eq_if' cap_get_tag_isCap isCap_simps
                                    ccap_relation_ep_helpers) apply ceqv apply clarsimp apply (rule ccorres_Cond_rhs) 
            (* case: we send the IPC *)
             apply clarsimp apply (simp add: liftE_def bind_assoc) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule_tac ccorres_split_nothrow_novcg) apply (rule_tac P=\<top> and P'=invs'
                          and R="{s.
                        (cfault_rel (Some fault)
                        (seL4_Fault_lift(current_fault_' (globals s)))
                         (lookup_fault_lift(original_lookup_fault_'  s)))}"
                          in threadSet_ccorres_lemma4) apply vcg apply (clarsimp simp: typ_heap_simps' rf_sr_tcb_update_twice) apply (intro conjI allI impI) apply (simp add: typ_heap_simps' rf_sr_def) apply (rule rf_sr_tcb_update_no_queue2[unfolded rf_sr_def, simplified],
                         assumption+, (simp add: typ_heap_simps')+) apply (rule ball_tcb_cte_casesI, simp+) apply (simp add: ctcb_relation_def cthread_state_relation_def) apply (case_tac "tcbState tcb", simp+) apply (simp add: rf_sr_def) apply (rule rf_sr_tcb_update_no_queue2[unfolded rf_sr_def, simplified],
                       assumption+, (simp add: typ_heap_simps' | simp only: hrs_mem_update_use_hrs_mem)+) apply (rule ball_tcb_cte_casesI, simp+) apply (clarsimp simp: typ_heap_simps') apply (simp add: ctcb_relation_def cthread_state_relation_def) apply (rule conjI) apply (case_tac "tcbState tcb", simp+) apply (simp add: cfault_rel_def) apply (clarsimp) apply (clarsimp simp: seL4_Fault_lift_def Let_def is_cap_fault_def
                                split: if_split_asm) apply ceqv apply csymbr apply csymbr apply csymbr apply (ctac (no_vcg) add: sendIPC_ccorres) apply (ctac (no_vcg) add: ccorres_return_CE [unfolded returnOk_def comp_def]) apply wp apply (wp threadSet_pred_tcb_no_state threadSet_invs_trivial threadSet_typ_at_lifts
                    | simp)+ apply (clarsimp simp: guard_is_UNIV_def) apply (subgoal_tac "capEPBadge epcap && mask 28 = capEPBadge epcap") apply (clarsimp simp: cap_get_tag_isCap isEndpointCap_def isCap_simps
                                    ccap_relation_ep_helpers) apply (frule cap_get_tag_isCap(4)[symmetric]) apply (clarsimp simp: cap_get_tag_EndpointCap) apply (drule cap_get_tag_isCap(4) [symmetric]) apply (clarsimp simp: isCap_simps cap_endpoint_cap_lift cap_lift_capEPBadge_mask_eq) apply (clarsimp simp: case_bool_If) apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg_throws) apply clarsimp apply (clarsimp simp add: throwError_def throw_def return_def) apply (rule conseqPre, vcg) apply (clarsimp simp: EXCEPTION_FAULT_def EXCEPTION_NONE_def) apply (simp add: cfault_rel2_def cfault_rel_def EXCEPTION_FAULT_def) apply (simp add: seL4_Fault_CapFault_lift) apply (simp add: lookup_fault_missing_capability_lift is_cap_fault_def) apply clarsimp apply vcg apply clarsimp apply (rule ccorres_split_throws) apply (rule_tac P=\<top> and P'="{x. errstate x= err'}" in ccorres_from_vcg_throws) apply clarsimp apply (clarsimp simp add: throwError_def throw_def return_def) apply (rule conseqPre, vcg) apply (clarsimp simp: EXCEPTION_FAULT_def EXCEPTION_NONE_def) apply (simp add: cfault_rel2_def cfault_rel_def EXCEPTION_FAULT_def) apply (simp add: seL4_Fault_CapFault_lift is_cap_fault_def) apply (erule lookup_failure_rel_fault_lift [rotated, unfolded EXCEPTION_NONE_def, simplified]
                 , assumption) apply vcg apply (clarsimp simp: inQ_def) apply (rule_tac Q="\<lambda>a b. invs' b \<and> st_tcb_at' simple' tptr b
                                 \<and> sch_act_not tptr b \<and> valid_cap' a b
                                 \<and> (\<forall>p. tptr \<notin> set (ksReadyQueues b p))"
                 and E="\<lambda> _. \<top>"
                 in hoare_post_impErr) apply (wp) apply (clarsimp simp: isCap_simps) apply (clarsimp simp: valid_cap'_def pred_tcb_at') apply simp apply (clarsimp simp: if_1_0_0) apply (vcg exspec=lookupCap_modifies) apply clarsimp apply wp apply (clarsimp simp: if_1_0_0) apply (vcg) apply (clarsimp, vcg) apply (rule conseqPre, vcg) apply clarsimp apply (clarsimp simp: if_1_0_0) apply fastforce done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>p. tptr \<notin> set (ksReadyQueues s p))) (UNIV \<inter> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr tptr\<rbrace>) [] (sendFaultIPC tptr fault) (Call sendFaultIPC_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>p. tptr \<notin> set (ksReadyQueues s p))) (UNIV \<inter> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr tptr\<rbrace>) [] (sendFaultIPC tptr fault) (Call sendFaultIPC_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>p. tptr \<notin> set (ksReadyQueues s p))) (UNIV \<inter> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr tptr\<rbrace>) [] (sendFaultIPC tptr fault) (Call sendFaultIPC_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>tptra. tptra = tcb_ptr_to_ctcb_ptr tptr \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q796 tptra) (?Q'796 tptra) [SKIP] (doE handlerCPtr <- liftE (threadGet tcbFaultHandler tptr);
handlerCap <- capFaultOnFailure handlerCPtr False (lookupCap tptr handlerCPtr);
case handlerCap of capability.EndpointCap epptr x True xa canGrant canGrantReply \<Rightarrow> if canGrant \<or> canGrantReply then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge handlerCap) canGrant True tptr (capEPPtr handlerCap)
od else throw $ Fault_H.fault.CapFault handlerCPtr False $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap epptr x False xa canGrant canGrantReply \<Rightarrow> throw $ Fault_H.fault.CapFault handlerCPtr False $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.fault.CapFault handlerCPtr False $ Fault_H.lookup_failure.MissingCapability 0
odE) (\<acute>original_lookup_fault :== \<acute>current_lookup_fault;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tptra} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tptra\<rightarrow>[''tcbFaultHandler_C''])));;
(\<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tptra,\<acute>handlerCPtr);;
(IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>handlerCPtr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tptra} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tptra\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tptra} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tptra\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tptra,ep_Ptr (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>handlerCPtr,SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI)))))))))
 2. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> ?Q796 tptra s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (2 subgoals):
 1. ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q796 (tcb_ptr_to_ctcb_ptr tptr)) (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) [SKIP] (do handlerCPtr <- threadGet tcbFaultHandler tptr;
doE handlerCap <- capFaultOnFailure handlerCPtr False (lookupCap tptr handlerCPtr);
case handlerCap of capability.EndpointCap epptr x True xa canGrant canGrantReply \<Rightarrow> if canGrant \<or> canGrantReply then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge handlerCap) canGrant True tptr (capEPPtr handlerCap)
od else throw $ Fault_H.fault.CapFault handlerCPtr False $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap epptr x False xa canGrant canGrantReply \<Rightarrow> throw $ Fault_H.fault.CapFault handlerCPtr False $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.fault.CapFault handlerCPtr False $ Fault_H.lookup_failure.MissingCapability 0
odE
od) (\<acute>original_lookup_fault :== \<acute>current_lookup_fault;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C''])));;
(\<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,\<acute>handlerCPtr);;
(IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>handlerCPtr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>handlerCPtr,SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI)))))))))
 2. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> ?Q796 tptra s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (4 subgoals):
 1. ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q796 (tcb_ptr_to_ctcb_ptr tptr)) ?Q'808 [SKIP] (do handlerCPtr <- threadGet tcbFaultHandler tptr;
doE handlerCap <- capFaultOnFailure handlerCPtr False (lookupCap tptr handlerCPtr);
case handlerCap of capability.EndpointCap epptr x True xa canGrant canGrantReply \<Rightarrow> if canGrant \<or> canGrantReply then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge handlerCap) canGrant True tptr (capEPPtr handlerCap)
od else throw $ Fault_H.fault.CapFault handlerCPtr False $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap epptr x False xa canGrant canGrantReply \<Rightarrow> throw $ Fault_H.fault.CapFault handlerCPtr False $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.fault.CapFault handlerCPtr False $ Fault_H.lookup_failure.MissingCapability 0
odE
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C''])));;
(\<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,\<acute>handlerCPtr);;
(IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>handlerCPtr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>handlerCPtr,SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))))
 2. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault ?Q'808
 3. \<And>s. ?Q796 (tcb_ptr_to_ctcb_ptr tptr) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 4. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> ?Q796 tptra s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (8 subgoals):
 1. ccorres ?r'812 ?xf'812 (?P817 (tcb_ptr_to_ctcb_ptr tptr)) ?P'812 [SKIP] (threadGet tcbFaultHandler tptr) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))))
 2. \<And>rv' t t'. ceqv \<Gamma> ?xf'812 rv' t t' (\<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,\<acute>handlerCPtr);;
(IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>handlerCPtr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>handlerCPtr,SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))) (?d'812 rv')
 3. \<And>rv rv'. ?r'812 rv rv' \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q812 rv) (?Q'812 rv rv') [SKIP] (doE handlerCap <- capFaultOnFailure rv False (lookupCap tptr rv);
case handlerCap of capability.EndpointCap epptr x bool1 xa canGrant canGrantReply \<Rightarrow> case bool1 of True \<Rightarrow> if canGrant \<or> canGrantReply then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge handlerCap) canGrant True tptr (capEPPtr handlerCap)
od else throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0
odE) (?d'812 rv')
 4. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>?Q812\<rbrace>
 5. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. ?r'812 rv (?xf'812 s) \<longrightarrow> s \<in> ?Q'812 rv (?xf'812 s)}
 6. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (?P'812 \<inter> ?R'812)
 7. \<And>s. (?P817 (tcb_ptr_to_ctcb_ptr tptr) and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 8. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (?P817 tptra and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (7 subgoals):
 1. \<And>rv' t t'. ceqv \<Gamma> handlerCPtr_' rv' t t' (\<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,\<acute>handlerCPtr);;
(IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>handlerCPtr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>handlerCPtr,SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))) (?d'812 rv')
 2. \<And>rv rv'. rv = rv' \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q812 rv) (?Q'812 rv rv') [SKIP] (doE handlerCap <- capFaultOnFailure rv False (lookupCap tptr rv);
case handlerCap of capability.EndpointCap epptr x bool1 xa canGrant canGrantReply \<Rightarrow> case bool1 of True \<Rightarrow> if canGrant \<or> canGrantReply then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge handlerCap) canGrant True tptr (capEPPtr handlerCap)
od else throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0
odE) (?d'812 rv')
 3. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>?Q812\<rbrace>
 4. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> ?Q'812 rv (handlerCPtr_' s)}
 5. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 6. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 7. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (6 subgoals):
 1. \<And>rv rv'. rv = rv' \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q812 rv) (?Q'812 rv rv') [SKIP] (doE handlerCap <- capFaultOnFailure rv False (lookupCap tptr rv);
case handlerCap of capability.EndpointCap epptr x bool1 xa canGrant canGrantReply \<Rightarrow> case bool1 of True \<Rightarrow> if canGrant \<or> canGrantReply then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge handlerCap) canGrant True tptr (capEPPtr handlerCap)
od else throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0
odE) (\<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv');;
(IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI)))))))
 2. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>?Q812\<rbrace>
 3. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> ?Q'812 rv (handlerCPtr_' s)}
 4. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 5. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 6. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (15 subgoals):
 1. \<And>rv rv'. rv = rv' \<Longrightarrow> ccorres (?f'1448 rv rv' \<currency> ?r'1448 rv rv') (liftxf (?es1448 rv rv') (?ef'1448 rv rv') (?vf'1448 rv rv') (?xf''1448 rv rv')) (?P1449 rv) (?C'1448 rv rv') [] (capFaultOnFailure rv False (lookupCap tptr rv)) (Call lookupCap_'proc)
 2. \<And>rv rv' x y s. rv = rv' \<Longrightarrow> globals (s\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' y\<rparr>) = globals s
 3. \<And>rv rv' a s t. rv = rv' \<Longrightarrow> ?es1448 rv rv' (s\<lparr>globals := globals t, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) = ?es1448 rv rv' t
 4. \<And>rv rv' a s t. rv = rv' \<Longrightarrow> lu_ret___struct_lookupCap_ret_C_' (s\<lparr>globals := globals t, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) = ?xf''1448 rv rv' t
 5. \<And>rv rv' s. rv = rv' \<Longrightarrow> globals (cPtr_'_update (\<lambda>_. rv') (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) s)) = globals s
 6. \<And>rv rv' rv'a t t'. rv = rv' \<Longrightarrow> ceqv \<Gamma> lu_ret___struct_lookupCap_ret_C_' rv'a t t' (IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI)))))) (?d'1448 rv rv' rv'a)
 7. \<And>rv rv' rva rv'a. \<lbrakk>rv = rv'; ?r'1448 rv rv' rva (?vf'1448 rv rv' rv'a); ?ef'1448 rv rv' rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1448 rv rv' rva) (?Q'1448 rv rv' rva rv'a) [SKIP] (case rva of capability.EndpointCap epptr x bool1 xa canGrant canGrantReply \<Rightarrow> case bool1 of True \<Rightarrow> if canGrant \<or> canGrantReply then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge rva) canGrant True tptr (capEPPtr rva)
od else throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0) (?d'1448 rv rv' rv'a)
 8. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; ?ef'1448 rv rv' rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'1448 rv rv' err (?ef'1448 rv rv' rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (?d'1448 rv rv' rv'a)
 9. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>?Q1448 rv rv'\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (?ef'1448 rv rv' (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ?r'1448 rv rv' rva (?vf'1448 rv rv' (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> ?Q'1448 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s))) \<and> (?ef'1448 rv rv' (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. ?f'1448 rv rv' err (?ef'1448 rv rv' (lu_ret___struct_lookupCap_ret_C_' s)) (?es1448 rv rv' s) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (?es1448 rv rv' s)))}
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv rv'. rv = rv' \<Longrightarrow> ccorres (?f1451 rv rv' \<currency> ?r'1448 rv rv') (liftxf (?es1448 rv rv') (?ef'1448 rv rv') (?vf'1448 rv rv') (?xf''1448 rv rv')) (?P1449 rv) (?C'1448 rv rv') [] (lookupCap tptr rv) (Call lookupCap_'proc)
 2. \<And>rv rv' x y s. rv = rv' \<Longrightarrow> globals (s\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' y\<rparr>) = globals s
 3. \<And>rv rv' a s t. rv = rv' \<Longrightarrow> ?es1448 rv rv' (s\<lparr>globals := globals t, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) = ?es1448 rv rv' t
 4. \<And>rv rv' a s t. rv = rv' \<Longrightarrow> lu_ret___struct_lookupCap_ret_C_' (s\<lparr>globals := globals t, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) = ?xf''1448 rv rv' t
 5. \<And>rv rv' s. rv = rv' \<Longrightarrow> globals (cPtr_'_update (\<lambda>_. rv') (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) s)) = globals s
 6. \<And>rv rv' rv'a t t'. rv = rv' \<Longrightarrow> ceqv \<Gamma> lu_ret___struct_lookupCap_ret_C_' rv'a t t' (IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI)))))) (?d'1448 rv rv' rv'a)
 7. \<And>rv rv' rva rv'a. \<lbrakk>rv = rv'; ?r'1448 rv rv' rva (?vf'1448 rv rv' rv'a); ?ef'1448 rv rv' rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1448 rv rv' rva) (?Q'1448 rv rv' rva rv'a) [SKIP] (case rva of capability.EndpointCap epptr x bool1 xa canGrant canGrantReply \<Rightarrow> case bool1 of True \<Rightarrow> if canGrant \<or> canGrantReply then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge rva) canGrant True tptr (capEPPtr rva)
od else throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0) (?d'1448 rv rv' rv'a)
 8. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; ?ef'1448 rv rv' rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> ?f1451 rv rv' w (?ef'1448 rv rv' rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (?d'1448 rv rv' rv'a)
 9. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>?Q1448 rv rv'\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (?ef'1448 rv rv' (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ?r'1448 rv rv' rva (?vf'1448 rv rv' (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> ?Q'1448 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s))) \<and> (?ef'1448 rv rv' (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> ?f1451 rv rv' w (?ef'1448 rv rv' (lu_ret___struct_lookupCap_ret_C_' s)) (?es1448 rv rv' s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (?es1448 rv rv' s)))}
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv rv' x y s. rv = rv' \<Longrightarrow> globals (s\<lparr>lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' y\<rparr>) = globals s
 2. \<And>rv rv' a s t. rv = rv' \<Longrightarrow> errstate (s\<lparr>globals := globals t, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) = errstate t
 3. \<And>rv rv' a s t. rv = rv' \<Longrightarrow> lu_ret___struct_lookupCap_ret_C_' (s\<lparr>globals := globals t, lu_ret___struct_lookupCap_ret_C_' := ret__struct_lookupCap_ret_C_' t\<rparr>) = ret__struct_lookupCap_ret_C_' t
 4. \<And>rv rv' s. rv = rv' \<Longrightarrow> globals (cPtr_'_update (\<lambda>_. rv') (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) s)) = globals s
 5. \<And>rv rv' rv'a t t'. rv = rv' \<Longrightarrow> ceqv \<Gamma> lu_ret___struct_lookupCap_ret_C_' rv'a t t' (IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(SCAST(32 signed \<rightarrow> 32) 0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI)))))) (?d'1448 rv rv' rv'a)
 6. \<And>rv rv' rva rv'a. \<lbrakk>rv = rv'; ccap_relation rva (lookupCap_ret_C.cap_C rv'a); lookupCap_ret_C.status_C rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1448 rv rv' rva) (?Q'1448 rv rv' rva rv'a) [SKIP] (case rva of capability.EndpointCap epptr x bool1 xa canGrant canGrantReply \<Rightarrow> case bool1 of True \<Rightarrow> if canGrant \<or> canGrantReply then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge rva) canGrant True tptr (capEPPtr rva)
od else throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0) (?d'1448 rv rv' rv'a)
 7. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (?d'1448 rv rv' rv'a)
 8. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>?Q1448 rv rv'\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 9. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> ?Q'1448 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s))) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 10. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
A total of 14 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' rv'a t t'. rv = rv' \<Longrightarrow> ceqv \<Gamma> lu_ret___struct_lookupCap_ret_C_' rv'a t t' (IF lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI)))))) (?d'1448 rv' rv' rv'a)
 2. \<And>rv rv' rva rv'a. \<lbrakk>rv = rv'; ccap_relation rva (lookupCap_ret_C.cap_C rv'a); lookupCap_ret_C.status_C rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1448 rv rv' rva) (?Q'1448 rv rv' rva rv'a) [SKIP] (case rva of capability.EndpointCap epptr x bool1 xa canGrant canGrantReply \<Rightarrow> case bool1 of True \<Rightarrow> if canGrant \<or> canGrantReply then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge rva) canGrant True tptr (capEPPtr rva)
od else throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0) (?d'1448 rv rv' rv'a)
 3. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (?d'1448 rv rv' rv'a)
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>?Q1448 rv rv'\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> ?Q'1448 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s))) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 6. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 7. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 8. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 9. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 10. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv rv' rva rv'a. \<lbrakk>rv = rv'; ccap_relation rva (lookupCap_ret_C.cap_C rv'a); lookupCap_ret_C.status_C rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1448 rv rv' rva) (?Q'1448 rv rv' rva rv'a) [SKIP] (case rva of capability.EndpointCap epptr x bool1 xa canGrant canGrantReply \<Rightarrow> case bool1 of True \<Rightarrow> if canGrant \<or> canGrantReply then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge rva) canGrant True tptr (capEPPtr rva)
od else throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 2. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>?Q1448 rv rv'\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> ?Q'1448 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s))) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv rv' epcap epcap'. \<lbrakk>rv = rv'; ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1448 rv rv' epcap) (?Q'1448 rv rv' epcap epcap') [SKIP] (case epcap of capability.EndpointCap epptr x bool1 xa canGrant canGrantReply \<Rightarrow> case bool1 of True \<Rightarrow> if canGrant \<or> canGrantReply then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) canGrant True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.fault.CapFault rv False $ Fault_H.lookup_failure.MissingCapability 0) (IF lookupCap_ret_C.status_C epcap' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C epcap';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 2. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>?Q1448 rv rv'\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> ?Q'1448 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s))) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1448 rv' rv' epcap) (?Q'1448 rv' rv' epcap epcap') [SKIP] (case epcap of capability.EndpointCap epptr x True xa canGrant canGrantReply \<Rightarrow> if canGrant \<or> canGrantReply then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) canGrant True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap epptr x False xa canGrant canGrantReply \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0) (IF False THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C epcap';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 2. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>?Q1448 rv rv'\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> ?Q'1448 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s))) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1448 rv' rv' epcap) (?Q'1448 rv' rv' epcap epcap') [SKIP] (case epcap of capability.EndpointCap epptr x True xa canGrant canGrantReply \<Rightarrow> if canGrant \<or> canGrantReply then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) canGrant True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap epptr x False xa canGrant canGrantReply \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0) (\<acute>handlerCap :== lookupCap_ret_C.cap_C epcap';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI)))))
 2. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>?Q1448 rv rv'\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> ?Q'1448 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s))) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1448 rv' rv' epcap) (?G'2969 rv' rv' epcap epcap') [SKIP] (case epcap of capability.EndpointCap epptr x True xa canGrant canGrantReply \<Rightarrow> if canGrant \<or> canGrantReply then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) canGrant True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap epptr x False xa canGrant canGrantReply \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))
 2. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>?Q1448 rv rv'\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?G'2969 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s)})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1448 rv' rv' epcap) (?G'2969 rv' rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))
 2. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>?Q1448 rv rv'\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?G'2969 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s)})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1448 rv' rv' epcap) (?G'2969 rv' rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI)))
 2. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>?Q1448 rv rv'\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?G'2969 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s)})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1448 rv' rv' epcap) (?G'2969 rv' rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))
 2. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>?Q1448 rv rv'\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?G'2969 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s)})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1448 rv' rv' epcap) (?G'2969 rv' rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI)
 2. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>?Q1448 rv rv'\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?G'2969 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s)})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (12 subgoals):
 1. \<And>rv' epcap epcap' s. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. True \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrace>)
 2. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI) (?y'3507 rv' epcap epcap' rv'a)
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3512 rv' rv' epcap) (?Q3507 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (?y'3507 rv' epcap epcap' (from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))))
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?Q3507 rv' epcap epcap'}
 5. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. ?P3512 rv rv' a and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 7. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 8. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 9. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 10. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' epcap epcap' s. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. True \<and> (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. ret__unsigned_' t = cap_get_tag (lookupCap_ret_C.cap_C epcap') \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C epcap') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C epcap') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C epcap') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')), ret__int_' := if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) \<noteq> 0 then 1 else 0\<rparr>) \<in> rf_sr \<and> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C epcap') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')), ret__int_' := if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) \<noteq> 0 then 1 else 0\<rparr>) \<in> rf_sr \<and> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')), ret__int_' := 0\<rparr>) \<in> rf_sr \<and> 0 = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C epcap') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := cap_get_tag (lookupCap_ret_C.cap_C epcap'), ret__int_' := 0\<rparr>) \<in> rf_sr \<and> 0 = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)))}
 2. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI) (?y'3507 rv' epcap epcap' rv'a)
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3512 rv' rv' epcap) (?Q3507 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (?y'3507 rv' epcap epcap' (from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))))
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?Q3507 rv' epcap epcap'}
 5. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. ?P3512 rv rv' a and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 7. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 8. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 9. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 10. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv'a t t' (IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI) (?y'3507 rv' epcap epcap' rv'a)
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3512 rv' rv' epcap) (?Q3507 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (?y'3507 rv' epcap epcap' (from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))))
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?Q3507 rv' epcap epcap'}
 4. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. ?P3512 rv rv' a and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 7. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 8. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 9. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 10. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3512 rv' rv' epcap) (?Q3507 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (IF from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI)
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?Q3507 rv' epcap epcap'}
 3. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. ?P3512 rv rv' a and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 6. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 7. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 8. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 9. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 10. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (10 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P3512 rv' rv' epcap) (?Q3507 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (IF isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI)
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?Q3507 rv' epcap epcap'}
 3. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. ?P3512 rv rv' a and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 6. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 7. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 8. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 9. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 10. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (11 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3913 rv' rv' epcap) (?S3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> ?S3911 rv' epcap epcap') \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 4. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> ?Q3913 rv rv' a b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 7. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 8. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 9. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 10. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3913 rv' rv' epcap) (?S3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> ?S3911 rv' epcap epcap') \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 4. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> ?Q3913 rv rv' a b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 7. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 8. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 9. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 10. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3913 rv' rv' epcap) (?S3911 rv' epcap epcap') [SKIP] (liftE (do y <- threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> ?S3911 rv' epcap epcap') \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 4. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> ?Q3913 rv rv' a b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 7. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 8. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 9. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 10. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3913 rv' rv' epcap) (?S3911 rv' epcap epcap') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr;
r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> ?S3911 rv' epcap epcap') \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 4. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> ?Q3913 rv rv' a b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 7. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 8. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 9. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 10. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3913 rv' rv' epcap) (?S3911 rv' epcap epcap') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr;
r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
(\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> ?S3911 rv' epcap epcap') \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 4. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> ?Q3913 rv rv' a b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 7. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 8. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 9. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 10. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3913 rv' rv' epcap) (?S3911 rv' epcap epcap') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr;
r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> ?S3911 rv' epcap epcap') \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 4. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> ?Q3913 rv rv' a b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 7. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 8. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 9. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 10. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3913 rv' rv' epcap) (?S3911 rv' epcap epcap') [SKIP] (do y <- threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr;
r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
(\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> ?S3911 rv' epcap epcap') \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 4. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> ?Q3913 rv rv' a b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 7. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 8. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 9. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 10. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ccorres (?r'3953 rv' epcap epcap') (?xf'3953 rv' epcap epcap') (?P3958 rv' rv' epcap) (?S3911 rv' epcap epcap') [] (threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI)
 2. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'3953 rv' epcap epcap') rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 3. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; ?r'3953 rv' epcap epcap' rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'3953 rv' epcap epcap') (?xf'3953 rv' epcap epcap') (?Q'3953 rv' epcap epcap')
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> ?S3911 rv' epcap epcap') \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 8. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 9. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (?P3958 rv rv' a and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>rv' epcap epcap' s tcb. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q3960 rv' epcap epcap' s tcb) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI {s'. (s\<lparr>ksPSpace := (ksPSpace s)(tptr \<mapsto> injectKOS (tcbFault_update (\<lambda>_. Some fault) tcb))\<rparr>, s') \<in> rf_sr}
 2. \<And>rv' epcap epcap' s s' tcb tcb'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; (s, s') \<in> rf_sr; True; ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> s' \<in> ?Q3960 rv' epcap epcap' s tcb
 3. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 8. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 9. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv' epcap epcap' s s' tcb tcb'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; (s, s') \<in> rf_sr; True; ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> s' \<in> {sa. sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr \<and> (\<forall>t. ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals sa)) \<longrightarrow> (seL4_Fault_get_tag (current_fault_' (globals sa)) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> hrs_htd (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) (current_fault_' (globals sa))) (t_hrs_' (globals sa))) \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr tptr \<and> (s\<lparr>ksPSpace := (ksPSpace s)(tptr \<mapsto> injectKOS (tcbFault_update (\<lambda>_. Some fault) tcb))\<rparr>, globals_update (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) (original_lookup_fault_' sa)) (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) (current_fault_' (globals sa))) x))) (sa\<lparr>ret__unsigned_' := SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rparr>)) \<in> rf_sr) \<and> (seL4_Fault_get_tag (current_fault_' (globals sa)) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(tptr \<mapsto> injectKOS (tcbFault_update (\<lambda>_. Some fault) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) (current_fault_' (globals sa))))) sa\<lparr>ret__unsigned_' := seL4_Fault_get_tag (current_fault_' (globals sa))\<rparr>) \<in> rf_sr))}
 2. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 3. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 8. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 9. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; (s, s') \<in> rf_sr; ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s'))\<rbrakk> \<Longrightarrow> (seL4_Fault_get_tag (current_fault_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(tptr \<mapsto> KOTCB (tcbFault_update (\<lambda>_. Some fault) tcb))\<rparr>, globals_update (t_hrs_'_update (\<lambda>ths. hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr tptr) (tcbLookupFailure_C_update (\<lambda>_. original_lookup_fault_' s') (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr tptr) (tcbFault_C_update (\<lambda>_. current_fault_' (globals s')) (h_val (hrs_mem ths) (tcb_ptr_to_ctcb_ptr tptr)))) ths)) (tcb_ptr_to_ctcb_ptr tptr)))) ths)) (s'\<lparr>ret__unsigned_' := SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rparr>)) \<in> rf_sr) \<and> (seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(tptr \<mapsto> KOTCB (tcbFault_update (\<lambda>_. Some fault) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) (current_fault_' (globals s'))))) s') \<in> rf_sr)
 2. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 3. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 8. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 9. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; (s, s') \<in> rf_sr; ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(tptr \<mapsto> KOTCB (tcbFault_update (\<lambda>_. Some fault) tcb))\<rparr>, globals_update (t_hrs_'_update (\<lambda>ths. hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr tptr) (tcbLookupFailure_C_update (\<lambda>_. original_lookup_fault_' s') (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr tptr) (tcbFault_C_update (\<lambda>_. current_fault_' (globals s')) (h_val (hrs_mem ths) (tcb_ptr_to_ctcb_ptr tptr)))) ths)) (tcb_ptr_to_ctcb_ptr tptr)))) ths)) (s'\<lparr>ret__unsigned_' := SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rparr>)) \<in> rf_sr
 2. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; (s, s') \<in> rf_sr; ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(tptr \<mapsto> KOTCB (tcbFault_update (\<lambda>_. Some fault) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) (current_fault_' (globals s'))))) s') \<in> rf_sr
 3. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 8. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 9. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; cstate_relation s (globals s'); ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault; seL4_Fault_get_tag (current_fault_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cstate_relation (s\<lparr>ksPSpace := (ksPSpace s)(tptr \<mapsto> KOTCB (tcbFault_update (\<lambda>_. Some fault) tcb))\<rparr>) (t_hrs_'_update (\<lambda>ths. hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr tptr) (tcbLookupFailure_C_update (\<lambda>_. original_lookup_fault_' s') (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr tptr) (tcbFault_C_update (\<lambda>_. current_fault_' (globals s')) (h_val (hrs_mem ths) (tcb_ptr_to_ctcb_ptr tptr)))) ths)) (tcb_ptr_to_ctcb_ptr tptr)))) ths) (globals s'))
 2. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; (s, s') \<in> rf_sr; ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(tptr \<mapsto> KOTCB (tcbFault_update (\<lambda>_. Some fault) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) (current_fault_' (globals s'))))) s') \<in> rf_sr
 3. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 8. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 9. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; cstate_relation s (globals s'); ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault; seL4_Fault_get_tag (current_fault_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> getF (tcbFault_update (\<lambda>_. Some fault) tcb) = getF tcb
 2. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; cstate_relation s (globals s'); ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault; seL4_Fault_get_tag (current_fault_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> ctcb_relation (tcbFault_update (\<lambda>_. Some fault) tcb) (tcbLookupFailure_C_update (\<lambda>_. original_lookup_fault_' s') (tcbFault_C_update (\<lambda>_. current_fault_' (globals s')) tcb'))
 3. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; (s, s') \<in> rf_sr; ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(tptr \<mapsto> KOTCB (tcbFault_update (\<lambda>_. Some fault) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) (current_fault_' (globals s'))))) s') \<in> rf_sr
 4. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 5. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 8. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 9. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 10. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; cstate_relation s (globals s'); ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault; seL4_Fault_get_tag (current_fault_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> ctcb_relation (tcbFault_update (\<lambda>_. Some fault) tcb) (tcbLookupFailure_C_update (\<lambda>_. original_lookup_fault_' s') (tcbFault_C_update (\<lambda>_. current_fault_' (globals s')) tcb'))
 2. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; (s, s') \<in> rf_sr; ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(tptr \<mapsto> KOTCB (tcbFault_update (\<lambda>_. Some fault) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) (current_fault_' (globals s'))))) s') \<in> rf_sr
 3. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 8. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 9. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; cstate_relation s (globals s'); ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; tcbFaultHandler tcb = tcbFaultHandler_C tcb' \<and> cthread_state_relation_lifted (tcbState tcb) (thread_state_lift (tcbState_C tcb'), seL4_Fault_lift (tcbFault_C tcb')) \<and> tcbIPCBuffer tcb = tcbIPCBuffer_C tcb' \<and> carch_tcb_relation (tcbArch tcb) (tcbArch_C tcb') \<and> tcbQueued tcb = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C tcb'))) \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = tcbDomain_C tcb' \<and> UCAST(8 \<rightarrow> 32) (tcbPriority tcb) = tcbPriority_C tcb' \<and> UCAST(8 \<rightarrow> 32) (tcbMCP tcb) = tcbMCP_C tcb' \<and> tcbTimeSlice tcb = unat (tcbTimeSlice_C tcb') \<and> cfault_rel (tcbFault tcb) (seL4_Fault_lift (tcbFault_C tcb')) (lookup_fault_lift (tcbLookupFailure_C tcb')) \<and> option_to_ptr (tcbBoundNotification tcb) = tcbBoundNotification_C tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault; seL4_Fault_get_tag (current_fault_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cthread_state_relation_lifted (tcbState tcb) (thread_state_lift (tcbState_C tcb'), seL4_Fault_lift (current_fault_' (globals s')))
 2. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; (s, s') \<in> rf_sr; ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(tptr \<mapsto> KOTCB (tcbFault_update (\<lambda>_. Some fault) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) (current_fault_' (globals s'))))) s') \<in> rf_sr
 3. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 8. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 9. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; (s, s') \<in> rf_sr; ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> (s\<lparr>ksPSpace := (ksPSpace s)(tptr \<mapsto> KOTCB (tcbFault_update (\<lambda>_. Some fault) tcb))\<rparr>, globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) (current_fault_' (globals s'))))) s') \<in> rf_sr
 2. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 3. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 8. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 9. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; cstate_relation s (globals s'); ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cstate_relation (s\<lparr>ksPSpace := (ksPSpace s)(tptr \<mapsto> KOTCB (tcbFault_update (\<lambda>_. Some fault) tcb))\<rparr>) (t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) (current_fault_' (globals s')))) (globals s'))
 2. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 3. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 8. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 9. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; cstate_relation s (globals s'); ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> \<forall>x\<in>ran tcb_cte_cases. case x of (getF, setF) \<Rightarrow> getF (tcbFault_update (\<lambda>_. Some fault) tcb) = getF tcb
 2. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; cstate_relation s (globals s'); ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> ctcb_relation (tcbFault_update (\<lambda>_. Some fault) tcb) (tcbFault_C_update (\<lambda>_. current_fault_' (globals s')) (h_val (hrs_mem (t_hrs_' (globals s'))) (tcb_ptr_to_ctcb_ptr tptr)))
 3. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 8. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 9. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; cstate_relation s (globals s'); ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> ctcb_relation (tcbFault_update (\<lambda>_. Some fault) tcb) (tcbFault_C_update (\<lambda>_. current_fault_' (globals s')) (h_val (hrs_mem (t_hrs_' (globals s'))) (tcb_ptr_to_ctcb_ptr tptr)))
 2. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 3. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 8. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 9. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; cstate_relation s (globals s'); ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; ctcb_relation tcb tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> ctcb_relation (tcbFault_update (\<lambda>_. Some fault) tcb) (tcbFault_C_update (\<lambda>_. current_fault_' (globals s')) tcb')
 2. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 3. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 8. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 9. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; cstate_relation s (globals s'); ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; tcbFaultHandler tcb = tcbFaultHandler_C tcb' \<and> cthread_state_relation_lifted (tcbState tcb) (thread_state_lift (tcbState_C tcb'), seL4_Fault_lift (tcbFault_C tcb')) \<and> tcbIPCBuffer tcb = tcbIPCBuffer_C tcb' \<and> carch_tcb_relation (tcbArch tcb) (tcbArch_C tcb') \<and> tcbQueued tcb = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C tcb'))) \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = tcbDomain_C tcb' \<and> UCAST(8 \<rightarrow> 32) (tcbPriority tcb) = tcbPriority_C tcb' \<and> UCAST(8 \<rightarrow> 32) (tcbMCP tcb) = tcbMCP_C tcb' \<and> tcbTimeSlice tcb = unat (tcbTimeSlice_C tcb') \<and> cfault_rel (tcbFault tcb) (seL4_Fault_lift (tcbFault_C tcb')) (lookup_fault_lift (tcbLookupFailure_C tcb')) \<and> option_to_ptr (tcbBoundNotification tcb) = tcbBoundNotification_C tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cthread_state_relation_lifted (tcbState tcb) (thread_state_lift (tcbState_C tcb'), seL4_Fault_lift (current_fault_' (globals s'))) \<and> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (tcbLookupFailure_C tcb'))
 2. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 3. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 8. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 9. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; cstate_relation s (globals s'); ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; tcbFaultHandler tcb = tcbFaultHandler_C tcb' \<and> cthread_state_relation_lifted (tcbState tcb) (thread_state_lift (tcbState_C tcb'), seL4_Fault_lift (tcbFault_C tcb')) \<and> tcbIPCBuffer tcb = tcbIPCBuffer_C tcb' \<and> carch_tcb_relation (tcbArch tcb) (tcbArch_C tcb') \<and> tcbQueued tcb = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C tcb'))) \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = tcbDomain_C tcb' \<and> UCAST(8 \<rightarrow> 32) (tcbPriority tcb) = tcbPriority_C tcb' \<and> UCAST(8 \<rightarrow> 32) (tcbMCP tcb) = tcbMCP_C tcb' \<and> tcbTimeSlice tcb = unat (tcbTimeSlice_C tcb') \<and> cfault_rel (tcbFault tcb) (seL4_Fault_lift (tcbFault_C tcb')) (lookup_fault_lift (tcbLookupFailure_C tcb')) \<and> option_to_ptr (tcbBoundNotification tcb) = tcbBoundNotification_C tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cthread_state_relation_lifted (tcbState tcb) (thread_state_lift (tcbState_C tcb'), seL4_Fault_lift (current_fault_' (globals s')))
 2. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; cstate_relation s (globals s'); ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; tcbFaultHandler tcb = tcbFaultHandler_C tcb' \<and> cthread_state_relation_lifted (tcbState tcb) (thread_state_lift (tcbState_C tcb'), seL4_Fault_lift (tcbFault_C tcb')) \<and> tcbIPCBuffer tcb = tcbIPCBuffer_C tcb' \<and> carch_tcb_relation (tcbArch tcb) (tcbArch_C tcb') \<and> tcbQueued tcb = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C tcb'))) \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = tcbDomain_C tcb' \<and> UCAST(8 \<rightarrow> 32) (tcbPriority tcb) = tcbPriority_C tcb' \<and> UCAST(8 \<rightarrow> 32) (tcbMCP tcb) = tcbMCP_C tcb' \<and> tcbTimeSlice tcb = unat (tcbTimeSlice_C tcb') \<and> cfault_rel (tcbFault tcb) (seL4_Fault_lift (tcbFault_C tcb')) (lookup_fault_lift (tcbLookupFailure_C tcb')) \<and> option_to_ptr (tcbBoundNotification tcb) = tcbBoundNotification_C tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (tcbLookupFailure_C tcb'))
 3. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 8. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 9. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; cstate_relation s (globals s'); ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; tcbFaultHandler tcb = tcbFaultHandler_C tcb' \<and> cthread_state_relation_lifted (tcbState tcb) (thread_state_lift (tcbState_C tcb'), seL4_Fault_lift (tcbFault_C tcb')) \<and> tcbIPCBuffer tcb = tcbIPCBuffer_C tcb' \<and> carch_tcb_relation (tcbArch tcb) (tcbArch_C tcb') \<and> tcbQueued tcb = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C tcb'))) \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = tcbDomain_C tcb' \<and> UCAST(8 \<rightarrow> 32) (tcbPriority tcb) = tcbPriority_C tcb' \<and> UCAST(8 \<rightarrow> 32) (tcbMCP tcb) = tcbMCP_C tcb' \<and> tcbTimeSlice tcb = unat (tcbTimeSlice_C tcb') \<and> cfault_rel (tcbFault tcb) (seL4_Fault_lift (tcbFault_C tcb')) (lookup_fault_lift (tcbLookupFailure_C tcb')) \<and> option_to_ptr (tcbBoundNotification tcb) = tcbBoundNotification_C tcb'; invs' s; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (original_lookup_fault_' s')); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (tcbLookupFailure_C tcb'))
 2. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 3. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 8. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 9. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>epcap epcap' s s' tcb tcb' t. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; cstate_relation s (globals s'); ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; tcbFaultHandler tcb = tcbFaultHandler_C tcb' \<and> cthread_state_relation_lifted (tcbState tcb) (thread_state_lift (tcbState_C tcb'), seL4_Fault_lift (tcbFault_C tcb')) \<and> tcbIPCBuffer tcb = tcbIPCBuffer_C tcb' \<and> carch_tcb_relation (tcbArch tcb) (tcbArch_C tcb') \<and> tcbQueued tcb = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C tcb'))) \<and> UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = tcbDomain_C tcb' \<and> UCAST(8 \<rightarrow> 32) (tcbPriority tcb) = tcbPriority_C tcb' \<and> UCAST(8 \<rightarrow> 32) (tcbMCP tcb) = tcbMCP_C tcb' \<and> tcbTimeSlice tcb = unat (tcbTimeSlice_C tcb') \<and> (\<exists>cf'. seL4_Fault_lift (tcbFault_C tcb') = Some cf' \<and> (if is_cap_fault cf' then \<exists>lf'. lookup_fault_lift (tcbLookupFailure_C tcb') = Some lf' \<and> fault_to_H cf' lf' = tcbFault tcb else fault_to_H cf' undefined = tcbFault tcb)) \<and> option_to_ptr (tcbBoundNotification tcb) = tcbBoundNotification_C tcb'; invs' s; \<exists>cf'. seL4_Fault_lift (current_fault_' (globals s')) = Some cf' \<and> (if is_cap_fault cf' then \<exists>lf'. lookup_fault_lift (original_lookup_fault_' s') = Some lf' \<and> fault_to_H cf' lf' = Some fault else fault_to_H cf' undefined = Some fault); ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> \<exists>cf'. seL4_Fault_lift (current_fault_' (globals s')) = Some cf' \<and> (if is_cap_fault cf' then \<exists>lf'. lookup_fault_lift (tcbLookupFailure_C tcb') = Some lf' \<and> fault_to_H cf' lf' = Some fault else fault_to_H cf' undefined = Some fault)
 2. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 3. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 8. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 9. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>epcap epcap' s s' tcb tcb' t cf' cf'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; cstate_relation s (globals s'); ko_at' tcb tptr s; cslift s' (tcb_ptr_to_ctcb_ptr tptr) = Some tcb'; invs' s; ret__unsigned_' t = seL4_Fault_get_tag (current_fault_' (globals s')); seL4_Fault_get_tag (current_fault_' (globals s')) \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault; tcbFaultHandler tcb = tcbFaultHandler_C tcb'; seL4_Fault_lift (current_fault_' (globals s')) = Some cf'; if is_cap_fault cf' then \<exists>lf'. lookup_fault_lift (original_lookup_fault_' s') = Some lf' \<and> fault_to_H cf' lf' = Some fault else fault_to_H cf' undefined = Some fault; cthread_state_relation_lifted (tcbState tcb) (thread_state_lift (tcbState_C tcb'), Some cf'a); tcbIPCBuffer tcb = tcbIPCBuffer_C tcb'; carch_tcb_relation (tcbArch tcb) (tcbArch_C tcb'); tcbQueued tcb = to_bool (tcbQueued_CL (thread_state_lift (tcbState_C tcb'))); UCAST(8 \<rightarrow> 32) (tcbDomain tcb) = tcbDomain_C tcb'; UCAST(8 \<rightarrow> 32) (tcbPriority tcb) = tcbPriority_C tcb'; UCAST(8 \<rightarrow> 32) (tcbMCP tcb) = tcbMCP_C tcb'; tcbTimeSlice tcb = unat (tcbTimeSlice_C tcb'); option_to_ptr (tcbBoundNotification tcb) = tcbBoundNotification_C tcb'; seL4_Fault_lift (tcbFault_C tcb') = Some cf'a; if is_cap_fault cf'a then \<exists>lf'. lookup_fault_lift (tcbLookupFailure_C tcb') = Some lf' \<and> fault_to_H cf'a lf' = tcbFault tcb else fault_to_H cf'a undefined = tcbFault tcb\<rbrakk> \<Longrightarrow> if is_cap_fault cf' then \<exists>lf'. lookup_fault_lift (tcbLookupFailure_C tcb') = Some lf' \<and> fault_to_H cf' lf' = Some fault else True
 2. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 3. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 7. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 8. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 9. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 10. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv' epcap epcap' rv'a t t'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'3953 rv' epcap epcap' rv'a)
 2. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (?d'3953 rv' epcap epcap' rv'a)
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 7. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 8. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 9. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 10. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' epcap epcap' rv rv'a. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?Q'3953 rv' epcap epcap' rv rv'a) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'3953 rv' epcap epcap')
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 6. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 7. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 8. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 9. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 10. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' epcap epcap' rv rv'a ret__unsigned. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?G'4635 rv' epcap epcap' rv rv'a ret__unsigned) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
(\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> ?G'4635 rv' epcap epcap' rv rv'a v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap})
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 6. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 7. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 8. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 9. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 10. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' epcap epcap' rv rv'a ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')); unsigned_eret_2 = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?G'4752 rv' epcap epcap' rv rv'a ret__unsigned unsigned_eret_2) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(lookupCap_ret_C.cap_C epcap');;
(CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ret__unsigned,unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> ?G'4752 rv' epcap epcap' rv rv'a v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap})
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 6. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 7. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 8. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 9. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 10. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' epcap epcap' rv rv'a ret__unsigned unsigned_eret_2 unsigned_eret_3. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')); unsigned_eret_2 = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')); unsigned_eret_3 = capEPPtr_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3953 rv' epcap epcap' rv) (?G'4844 rv' epcap epcap' rv rv'a ret__unsigned unsigned_eret_2 unsigned_eret_3) [SKIP] (do r <- sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap);
return (Inr ())
od) (CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,ret__unsigned,unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>?Q3953 rv' epcap epcap'\<rbrace>
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> ?G'4844 rv' epcap epcap' rv rv'a v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap})
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 6. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 7. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 8. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 9. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 10. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv' epcap epcap' rv rv'a ret__unsigned unsigned_eret_2 unsigned_eret_3 rva xfdc. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')); unsigned_eret_2 = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')); unsigned_eret_3 = capEPPtr_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')); dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4910 rv' epcap epcap' rv rv'a ret__unsigned unsigned_eret_2 unsigned_eret_3 rva) (?Q'4910 rv' epcap epcap' rv rv'a ret__unsigned unsigned_eret_2 unsigned_eret_3 rva xfdc) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>rv' epcap epcap' rv rv'a ret__unsigned unsigned_eret_2 unsigned_eret_3. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')); unsigned_eret_2 = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')); unsigned_eret_3 = capEPPtr_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))\<rbrakk> \<Longrightarrow> \<lbrace>?R4912 rv' epcap epcap' rv\<rbrace> sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap) \<lbrace>?Q4910 rv' epcap epcap' rv rv'a ret__unsigned unsigned_eret_2 unsigned_eret_3\<rbrace>
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>\<lambda>rv. invs' and st_tcb_at' simple' tptr and sch_act_not tptr and ep_at' (capEPPtr epcap) and (\<lambda>s. \<forall>d p. tptr \<notin> set (ksReadyQueues s (d, p))) and ?R4912 rv' epcap epcap' rv\<rbrace>
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. epptr_'_update (\<lambda>_. ep_Ptr vb) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) (canGrantReply_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (canGrant_'_update (\<lambda>_. va) (badge_'_update (\<lambda>_. v) (do_call_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (blocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s)))))) \<in> UNIV \<inter> \<lbrace>\<acute>blocking = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>do_call = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge epcap\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant epcap)\<rbrace> \<inter> \<lbrace>\<acute>canGrantReply = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace> \<inter> \<lbrace>\<acute>epptr = ep_Ptr (capEPPtr epcap)\<rbrace> \<inter> \<lbrace>capEPBadge epcap && mask 28 = capEPBadge epcap\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'4910 rv' epcap epcap' rv rv'a v va vb rva (xfdc t)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap})
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 6. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 7. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 8. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 9. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 10. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' epcap epcap' rv rv'a ret__unsigned unsigned_eret_2 unsigned_eret_3. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; dc rv rv'a; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')); unsigned_eret_2 = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')); unsigned_eret_3 = capEPPtr_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))\<rbrakk> \<Longrightarrow> \<lbrace>?R4912 rv' epcap epcap' rv\<rbrace> sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap) \<lbrace>\<lambda>rva _. True\<rbrace>
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>\<lambda>rv. invs' and st_tcb_at' simple' tptr and sch_act_not tptr and ep_at' (capEPPtr epcap) and (\<lambda>s. \<forall>d p. tptr \<notin> set (ksReadyQueues s (d, p))) and ?R4912 rv' epcap epcap' rv\<rbrace>
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. epptr_'_update (\<lambda>_. ep_Ptr vb) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) (canGrantReply_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (canGrant_'_update (\<lambda>_. va) (badge_'_update (\<lambda>_. v) (do_call_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (blocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s)))))) \<in> UNIV \<inter> \<lbrace>\<acute>blocking = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>do_call = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge epcap\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant epcap)\<rbrace> \<inter> \<lbrace>\<acute>canGrantReply = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace> \<inter> \<lbrace>\<acute>epptr = ep_Ptr (capEPPtr epcap)\<rbrace> \<inter> \<lbrace>capEPBadge epcap && mask 28 = capEPBadge epcap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap})
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 5. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 6. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 7. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 8. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 9. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 10. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<lbrace>?R3956 rv' rv' epcap\<rbrace> threadSet (tcbFault_update (\<lambda>_. Some fault)) tptr \<lbrace>\<lambda>rv. invs' and st_tcb_at' simple' tptr and sch_act_not tptr and ep_at' (capEPPtr epcap) and (\<lambda>s. \<forall>d p. tptr \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>a. True)\<rbrace>
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'a. {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capCanGrant_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capEPPtr_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. epptr_'_update (\<lambda>_. ep_Ptr vb) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) (canGrantReply_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (canGrant_'_update (\<lambda>_. va) (badge_'_update (\<lambda>_. v) (do_call_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (blocking_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s)))))) \<in> UNIV \<inter> \<lbrace>\<acute>blocking = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>do_call = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge epcap\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (capEPCanGrant epcap)\<rbrace> \<inter> \<lbrace>\<acute>canGrantReply = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace> \<inter> \<lbrace>\<acute>epptr = ep_Ptr (capEPPtr epcap)\<rbrace> \<inter> \<lbrace>capEPBadge epcap && mask 28 = capEPBadge epcap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. lookupCap_ret_C.cap_C epcap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap})
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 5. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and ?R3956 rv rv' a) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 7. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 8. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 9. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 10. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. True) xfdc (\<lambda>rv rv'a. \<lbrace>capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) = capEPBadge epcap \<and> capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) = from_bool (capEPCanGrant epcap) \<and> capEPPtr_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) = capEPPtr epcap \<and> capEPBadge epcap && mask 28 = capEPBadge epcap \<and> cap_get_tag (lookupCap_ret_C.cap_C epcap') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace> \<inter> \<lbrace>cap_get_tag (lookupCap_ret_C.cap_C epcap') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrace>)
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 4. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 7. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 8. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 9. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 10. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) = capEPBadge epcap \<and> capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) = from_bool (capEPCanGrant epcap) \<and> capEPPtr_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) = capEPPtr epcap \<and> capEPBadge epcap && mask 28 = capEPBadge epcap \<and> cap_get_tag (lookupCap_ret_C.cap_C epcap') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 4. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 7. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 8. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 9. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 10. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; capEPBadge epcap && mask 28 = capEPBadge epcap\<rbrakk> \<Longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) = capEPBadge epcap \<and> capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) = from_bool (capEPCanGrant epcap) \<and> capEPPtr_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) = capEPPtr epcap \<and> capEPBadge epcap && mask 28 = capEPBadge epcap \<and> cap_get_tag (lookupCap_ret_C.cap_C epcap') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap
 2. \<And>epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> capEPBadge epcap && mask 28 = capEPBadge epcap
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 4. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 5. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 7. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 8. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 9. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 10. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> capEPBadge epcap && mask 28 = capEPBadge epcap
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 4. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 7. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 8. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 9. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 10. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isEndpointCap epcap; capEPCanSend epcap; capEPCanGrant epcap \<or> capEPCanGrantReply epcap; isEndpointCap epcap = (cap_get_tag (lookupCap_ret_C.cap_C epcap') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap)\<rbrakk> \<Longrightarrow> capEPBadge epcap && mask 28 = capEPBadge epcap
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 4. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 7. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 8. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 9. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 10. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>epcap'. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))) (capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))) True (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))))) (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; to_bool (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))); to_bool (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))) \<or> to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))); isEndpointCap (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))) (capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))) True (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')))))\<rbrakk> \<Longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) && mask 28 = capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 4. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 7. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 8. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 9. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 10. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>epcap'. \<lbrakk>lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; to_bool (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))); to_bool (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))) \<or> to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))); isEndpointCap (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))) (capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))) True (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))))); isEndpointCap (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))) (capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))) True (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))))) = (cap_get_tag (lookupCap_ret_C.cap_C epcap') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap)\<rbrakk> \<Longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap')) && mask 28 = capEPBadge_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C epcap'))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 3. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 4. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 6. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 7. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 8. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 9. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 10. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap))\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (if isEndpointCap epcap then case capEPCanSend epcap of True \<Rightarrow> if capEPCanGrant epcap \<or> capEPCanGrantReply epcap then withoutFailure $ do threadSet (tcbFault_update (\<lambda>_. Just fault)) tptr;
sendIPC True True (capEPBadge epcap) (capEPCanGrant epcap) True tptr (capEPPtr epcap)
od else throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 | False \<Rightarrow> throw $ Fault_H.fault.CapFault rv' False $ Fault_H.lookup_failure.MissingCapability 0 else throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 3. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 6. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 7. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 8. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 9. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 10. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (10 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; capEPCanSend epcap \<longrightarrow> isEndpointCap epcap \<longrightarrow> \<not> capEPCanGrant epcap \<and> \<not> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3912 rv' rv' epcap) (?T3911 rv' epcap epcap') [SKIP] (throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0))) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> ?T3911 rv' epcap epcap')}}
 3. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> ?R3912 rv rv' a b)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 6. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 7. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 8. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 9. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 10. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (10 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; capEPCanSend epcap \<longrightarrow> isEndpointCap epcap \<longrightarrow> \<not> capEPCanGrant epcap \<and> \<not> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (cfault_rel2 \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> UNIV)}}
 3. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 6. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 7. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 8. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 9. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 10. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (10 subgoals):
 1. \<And>rv' epcap epcap' \<sigma>. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; capEPCanSend epcap \<longrightarrow> isEndpointCap epcap \<longrightarrow> \<not> capEPCanGrant epcap \<and> \<not> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. (\<sigma>, s) \<in> rf_sr} \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) {},{s. \<exists>x\<in>fst (throwError (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', s) \<in> rf_sr \<and> (cfault_rel2 \<currency> dc) rv (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_' s)}
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> UNIV)}}
 3. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 6. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 7. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 8. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 9. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 10. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (10 subgoals):
 1. \<And>rv' epcap epcap' \<sigma>. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; capEPCanSend epcap \<longrightarrow> isEndpointCap epcap \<longrightarrow> \<not> capEPCanGrant epcap \<and> \<not> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. (\<sigma>, s) \<in> rf_sr} \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) {},{s. (\<sigma>, s) \<in> rf_sr \<and> ret__unsigned_long_' s \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> cfault_rel2 (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0)) (ret__unsigned_long_' s) (errstate s)}
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> UNIV)}}
 3. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 6. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 7. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 8. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 9. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 10. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (10 subgoals):
 1. \<And>rv' epcap epcap' \<sigma>. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; capEPCanSend epcap \<longrightarrow> isEndpointCap epcap \<longrightarrow> \<not> capEPCanGrant epcap \<and> \<not> capEPCanGrantReply epcap\<rbrakk> \<Longrightarrow> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = rv' && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> (\<forall>ta. lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0 && mask 6\<rparr> \<and> lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability \<longrightarrow> (\<sigma>, globals_update (\<lambda>x. x\<lparr>current_fault_' := ret__struct_seL4_Fault_C_' t, current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> cfault_rel2 (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0)) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) (errstate (globals_update (\<lambda>x. x\<lparr>current_fault_' := ret__struct_seL4_Fault_C_' t, current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT, global_exn_var_' := Return\<rparr>)))}
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> UNIV)}}
 3. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 6. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 7. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 8. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 9. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 10. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (10 subgoals):
 1. \<And>rv' epcap epcap' \<sigma> x t ta. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = 0; capEPCanSend epcap \<longrightarrow> isEndpointCap epcap \<longrightarrow> \<not> capEPCanGrant epcap \<and> \<not> capEPCanGrantReply epcap; (\<sigma>, x) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = rv', inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>; seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr>; lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability\<rbrakk> \<Longrightarrow> cfault_rel2 (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0)) 1 (errstate (globals_update (\<lambda>x. x\<lparr>current_fault_' := ret__struct_seL4_Fault_C_' t, current_lookup_fault_' := ret__struct_lookup_fault_C_' ta\<rparr>) x))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> UNIV)}}
 3. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 6. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 7. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 8. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 9. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 10. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (10 subgoals):
 1. \<And>rv' epcap epcap' \<sigma> x t ta. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = 0; capEPCanSend epcap \<longrightarrow> isEndpointCap epcap \<longrightarrow> \<not> capEPCanGrant epcap \<and> \<not> capEPCanGrantReply epcap; (\<sigma>, x) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = rv', inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>; seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault; lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr>; lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability\<rbrakk> \<Longrightarrow> \<exists>cf'. seL4_Fault_lift (ret__struct_seL4_Fault_C_' t) = Some cf' \<and> (if is_cap_fault cf' then \<exists>lf'. lookup_fault_lift (ret__struct_lookup_fault_C_' ta) = Some lf' \<and> fault_to_H cf' lf' = Some (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0)) else fault_to_H cf' undefined = Some (Fault_H.fault.CapFault rv' False (Fault_H.lookup_failure.MissingCapability 0)))
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> UNIV)}}
 3. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 6. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 7. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 8. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 9. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 10. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (10 subgoals):
 1. \<And>rv' epcap epcap' \<sigma> x t ta. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = 0; capEPCanSend epcap \<longrightarrow> isEndpointCap epcap \<longrightarrow> \<not> capEPCanGrant epcap \<and> \<not> capEPCanGrantReply epcap; (\<sigma>, x) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = rv', inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>; seL4_Fault_lift (ret__struct_seL4_Fault_C_' t) = Some (SeL4_Fault_CapFault \<lparr>seL4_Fault_CapFault_CL.address_CL = rv', inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>); lookup_fault_missing_capability_lift (ret__struct_lookup_fault_C_' ta) = \<lparr>lookup_fault_missing_capability_CL.bitsLeft_CL = 0\<rparr>; lookup_fault_get_tag (ret__struct_lookup_fault_C_' ta) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability\<rbrakk> \<Longrightarrow> if is_cap_fault (SeL4_Fault_CapFault \<lparr>seL4_Fault_CapFault_CL.address_CL = rv', inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>) then \<exists>lf'. lookup_fault_lift (ret__struct_lookup_fault_C_' ta) = Some lf' \<and> lookup_fault_to_H lf' = Fault_H.lookup_failure.MissingCapability 0 else lookup_fault_to_H undefined = Fault_H.lookup_failure.MissingCapability 0
 2. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> UNIV)}}
 3. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 5. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 6. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 7. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 8. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 9. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 10. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI {s. \<forall>rv. ret__int_' s = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> {s. (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> s \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>) \<and> (\<not> (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> s \<in> UNIV)}}
 2. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' epcap epcap'. \<lbrakk>ccap_relation epcap (lookupCap_ret_C.cap_C epcap'); lookupCap_ret_C.status_C epcap' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft3507 rv' epcap epcap'\<^esub> (?P'3510 rv' rv' epcap epcap') \<acute>ret__unsigned :== CALL cap_get_capType_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(lookupCap_ret_C.cap_C epcap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI \<lbrace>\<acute>ret__int = from_bool (isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap)) \<longrightarrow> isEndpointCap epcap \<and> capEPCanSend epcap \<and> (capEPCanGrant epcap \<or> capEPCanGrantReply epcap) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)\<rbrace>
 2. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> ?P'3510 rv rv' rva (lu_ret___struct_lookupCap_ret_C_' s) \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' err rv'a err'. \<lbrakk>rv = rv'; lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv rv' err) (?Q''1448 rv rv' err rv'a err') [SKIP] (throwError err) (IF lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 2. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 4. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 5. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 6. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 7. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 8. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (8 subgoals):
 1. \<And>rv' rv'a err' w. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv' rv' (Fault_H.fault.CapFault rv' False w)) (?Q''1448 rv' rv' (Fault_H.fault.CapFault rv' False w) rv'a err') [SKIP] (throwError (Fault_H.fault.CapFault rv' False w)) (IF True THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI;;
(\<acute>handlerCap :== lookupCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>handlerCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(\<acute>handlerCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(seL4_Fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFault_C''])) \<acute>current_fault)));;
\<acute>ret__unsigned :== CALL seL4_Fault_get_seL4_FaultType_'proc(\<acute>current_fault);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(lookup_fault_C) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbLookupFailure_C''])) \<acute>original_lookup_fault)))
FI;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capCanGrant_'proc(\<acute>handlerCap);;
\<acute>unsigned_eret_3 :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>handlerCap);;
CALL sendIPC_'proc(SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,\<acute>ret__unsigned,\<acute>unsigned_eret_2,SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr tptr,ep_Ptr \<acute>unsigned_eret_3);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
\<acute>current_lookup_fault :== CALL lookup_fault_missing_capability_new_'proc(0);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI))))))
 2. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''1448 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 4. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 5. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 6. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 7. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 8. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' rv'a err' w. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (cfault_rel2 \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE1448 rv' rv' (Fault_H.fault.CapFault rv' False w)) (?P'5154 rv' rv' (Fault_H.fault.CapFault rv' False w) rv'a err') [SKIP] (throwError (Fault_H.fault.CapFault rv' False w)) (IF True THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI)
 2. \<And>rv' rv'a err' w. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5153 rv' rv' (Fault_H.fault.CapFault rv' False w) rv'a err') IF True THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI {},UNIV
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>?QE1448 rv rv'\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?P'5154 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s) \<inter> ?R'5153 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' rv'a err' w. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> {x. errstate x = err'} \<and> (\<sigma>, s) \<in> rf_sr} IF True THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Fault_H.fault.CapFault rv' False w) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (cfault_rel2 \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>rv' rv'a err' w. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5153 rv' rv' (Fault_H.fault.CapFault rv' False w) rv'a err') IF True THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI {},UNIV
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s} \<inter> ?R'5153 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' rv'a err' w \<sigma>. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. errstate s = err' \<and> (\<sigma>, s) \<in> rf_sr} IF True THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI {},{s. \<exists>x\<in>fst (throwError (Fault_H.fault.CapFault rv' False w) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', s) \<in> rf_sr \<and> (cfault_rel2 \<currency> dc) rv (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_' s)}
 2. \<And>rv' rv'a err' w. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5153 rv' rv' (Fault_H.fault.CapFault rv' False w) rv'a err') IF True THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI {},UNIV
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s} \<inter> ?R'5153 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' rv'a err' w \<sigma>. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. errstate s = err' \<and> (\<sigma>, s) \<in> rf_sr} IF True THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI {},{s. (\<sigma>, s) \<in> rf_sr \<and> ret__unsigned_long_' s \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> cfault_rel2 (Fault_H.fault.CapFault rv' False w) (ret__unsigned_long_' s) (errstate s)}
 2. \<And>rv' rv'a err' w. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5153 rv' rv' (Fault_H.fault.CapFault rv' False w) rv'a err') IF True THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI {},UNIV
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s} \<inter> ?R'5153 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' rv'a err' w \<sigma>. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> {s. errstate s = err' \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (True \<longrightarrow> (\<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = rv' && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> (\<sigma>, globals_update (current_fault_'_update (\<lambda>_. ret__struct_seL4_Fault_C_' t)) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> cfault_rel2 (Fault_H.fault.CapFault rv' False w) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT) (errstate (globals_update (current_fault_'_update (\<lambda>_. ret__struct_seL4_Fault_C_' t)) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT, global_exn_var_' := Return\<rparr>)))) \<and> (\<not> True \<longrightarrow> False)}
 2. \<And>rv' rv'a err' w. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5153 rv' rv' (Fault_H.fault.CapFault rv' False w) rv'a err') IF True THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI {},UNIV
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s} \<inter> ?R'5153 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' rv'a w \<sigma> x t. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> 0; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) (errstate x); (\<sigma>, x) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = rv', inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>; seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel2 (Fault_H.fault.CapFault rv' False w) 1 (errstate (globals_update (current_fault_'_update (\<lambda>_. ret__struct_seL4_Fault_C_' t)) x))
 2. \<And>rv' rv'a err' w. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5153 rv' rv' (Fault_H.fault.CapFault rv' False w) rv'a err') IF True THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI {},UNIV
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s} \<inter> ?R'5153 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' rv'a w \<sigma> x t. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> 0; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) (errstate x); (\<sigma>, x) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = rv', inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>; seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> \<exists>cf'. seL4_Fault_lift (ret__struct_seL4_Fault_C_' t) = Some cf' \<and> (if is_cap_fault cf' then \<exists>lf'. lookup_fault_lift (current_lookup_fault_' (globals x)) = Some lf' \<and> fault_to_H cf' lf' = Some (Fault_H.fault.CapFault rv' False w) else fault_to_H cf' undefined = Some (Fault_H.fault.CapFault rv' False w))
 2. \<And>rv' rv'a err' w. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5153 rv' rv' (Fault_H.fault.CapFault rv' False w) rv'a err') IF True THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI {},UNIV
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s} \<inter> ?R'5153 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv' rv'a w \<sigma> x t. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> 0; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) (errstate x); (\<sigma>, x) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = rv', inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>; seL4_Fault_lift (ret__struct_seL4_Fault_C_' t) = Some (SeL4_Fault_CapFault \<lparr>seL4_Fault_CapFault_CL.address_CL = rv', inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>)\<rbrakk> \<Longrightarrow> \<exists>lf'. lookup_fault_lift (current_lookup_fault_' (globals x)) = Some lf' \<and> lookup_fault_to_H lf' = w
 2. \<And>rv' rv'a err' w. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5153 rv' rv' (Fault_H.fault.CapFault rv' False w) rv'a err') IF True THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI {},UNIV
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s} \<inter> ?R'5153 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (8 subgoals):
 1. \<And>rv' rv'a err' w. \<lbrakk>lookupCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupCap_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5153 rv' rv' (Fault_H.fault.CapFault rv' False w) rv'a err') IF True THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_FAULT)
FI {},UNIV
 2. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s} \<inter> ?R'5153 rv rv' err (lu_ret___struct_lookupCap_ret_C_' s) (errstate s)))}
 4. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 5. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 6. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 7. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 8. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (7 subgoals):
 1. \<And>rv rv'. rv = rv' \<Longrightarrow> \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a. (\<lambda>b. (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> (tcb_at' tptr and invs' and (\<lambda>b. (invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. inQ d p tcb \<and> \<not> inQ d p (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> (\<forall>ko d p. ko_at' ko tptr b \<and> inQ d p (tcbFault_update (\<lambda>_. Some fault) ko) \<and> \<not> inQ d p ko \<longrightarrow> tptr \<in> set (ksReadyQueues b (d, p))) \<and> ((\<exists>tcb. \<not> tcbQueued tcb \<and> tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb)) \<longrightarrow> ex_nonz_cap_to' tptr b \<and> tptr \<noteq> ksCurThread b) \<and> (\<forall>tcb. tcbQueued (tcbFault_update (\<lambda>_. Some fault) tcb) \<and> ksSchedulerAction b = ResumeCurrentThread \<longrightarrow> tcbQueued tcb \<or> tptr \<noteq> ksCurThread b)) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p))) \<and> True)) b) \<and> (\<not> (isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a)) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s} \<inter> \<lbrace>(True \<longrightarrow> True) \<and> (\<not> True \<longrightarrow> False)\<rbrace>))}
 3. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 4. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 5. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 6. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 7. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (7 subgoals):
 1. \<And>rv. \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a b. isEndpointCap a \<and> capEPCanSend a \<and> (capEPCanGrant a \<or> capEPCanGrantReply a) \<longrightarrow> tcb_at' tptr b \<and> invs' b \<and> tcb_at' tptr b \<and> (\<forall>d p. (\<exists>tcb. tcbQueued tcb \<and> tcbPriority tcb = p \<and> tcbDomain tcb = d \<and> (tcbQueued tcb \<longrightarrow> tcbDomain tcb \<noteq> d)) \<longrightarrow> tptr \<notin> set (ksReadyQueues b (d, p))) \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> ep_at' (capEPPtr a) b \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues b (d, p)))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s} \<inter> \<lbrace>(True \<longrightarrow> True) \<and> (\<not> True \<longrightarrow> False)\<rbrace>))}
 3. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 4. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 5. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 6. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 7. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (9 subgoals):
 1. \<And>rv. \<lbrace>?R1450 rv\<rbrace> capFaultOnFailure rv False (lookupCap tptr rv) \<lbrace>\<lambda>a b. invs' b \<and> st_tcb_at' simple' tptr b \<and> sch_act_not tptr b \<and> valid_cap' a b \<and> (\<forall>p. tptr \<notin> set (ksReadyQueues b p))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>rv rva s. invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_cap' rva s \<and> (\<forall>p. tptr \<notin> set (ksReadyQueues s p)) \<Longrightarrow> isEndpointCap rva \<and> capEPCanSend rva \<and> (capEPCanGrant rva \<or> capEPCanGrantReply rva) \<longrightarrow> tcb_at' tptr s \<and> invs' s \<and> tcb_at' tptr s \<and> (\<forall>d p. (\<exists>tcb. tcbQueued tcb \<and> tcbPriority tcb = p \<and> tcbDomain tcb = d \<and> (tcbQueued tcb \<longrightarrow> tcbDomain tcb \<noteq> d)) \<longrightarrow> tptr \<notin> set (ksReadyQueues s (d, p))) \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> ep_at' (capEPPtr rva) s \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues s (d, p)))
 3. \<And>rv e s. True \<Longrightarrow> True
 4. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s} \<inter> \<lbrace>(True \<longrightarrow> True) \<and> (\<not> True \<longrightarrow> False)\<rbrace>))}
 5. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and ?R1450 rv\<rbrace>
 6. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 7. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 8. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 9. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (8 subgoals):
 1. \<And>rv rva s. invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_cap' rva s \<and> (\<forall>p. tptr \<notin> set (ksReadyQueues s p)) \<Longrightarrow> isEndpointCap rva \<and> capEPCanSend rva \<and> (capEPCanGrant rva \<or> capEPCanGrantReply rva) \<longrightarrow> tcb_at' tptr s \<and> invs' s \<and> tcb_at' tptr s \<and> (\<forall>d p. (\<exists>tcb. tcbQueued tcb \<and> tcbPriority tcb = p \<and> tcbDomain tcb = d \<and> (tcbQueued tcb \<longrightarrow> tcbDomain tcb \<noteq> d)) \<longrightarrow> tptr \<notin> set (ksReadyQueues s (d, p))) \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> ep_at' (capEPPtr rva) s \<and> (\<forall>d p. tptr \<notin> set (ksReadyQueues s (d, p)))
 2. \<And>rv e s. True \<Longrightarrow> True
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s} \<inter> \<lbrace>(True \<longrightarrow> True) \<and> (\<not> True \<longrightarrow> False)\<rbrace>))}
 4. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. True \<and> invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>p. tptr \<notin> set (ksReadyQueues s p)))\<rbrace>
 5. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 6. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 7. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 8. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (8 subgoals):
 1. \<And>s v0 v1 v2 v3 v4 v5. \<lbrakk>invs' s; st_tcb_at' simple' tptr s; sch_act_not tptr s; valid_cap' (capability.EndpointCap v0 v1 True v3 v4 v5) s; \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)); v2; v4 \<or> v5\<rbrakk> \<Longrightarrow> tcb_at' tptr s \<and> ep_at' v0 s
 2. \<And>rv e s. True \<Longrightarrow> True
 3. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s} \<inter> \<lbrace>(True \<longrightarrow> True) \<and> (\<not> True \<longrightarrow> False)\<rbrace>))}
 4. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. True \<and> invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>p. tptr \<notin> set (ksReadyQueues s p)))\<rbrace>
 5. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 6. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 7. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 8. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (7 subgoals):
 1. \<And>rv e s. True \<Longrightarrow> True
 2. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s} \<inter> \<lbrace>(True \<longrightarrow> True) \<and> (\<not> True \<longrightarrow> False)\<rbrace>))}
 3. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. True \<and> invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>p. tptr \<notin> set (ksReadyQueues s p)))\<rbrace>
 4. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 5. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 6. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 7. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (6 subgoals):
 1. \<And>rv rv'. rv = rv' \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv'\<^esub> (?R'1448 rv rv') \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv') {s. (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) \<longrightarrow> s \<in> {sa. handlerCap_'_update (\<lambda>_. lookupCap_ret_C.cap_C (lu_ret___struct_lookupCap_ret_C_' s)) sa \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> ((if capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))))) \<and> ((if capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))) \<and> ((if cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>s\<^esup>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) = 0 \<longrightarrow> 0 = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))\<rbrace> \<inter> UNIV})) \<and> (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault rv False w \<and> lookup_failure_rel w (lookupCap_ret_C.status_C (lu_ret___struct_lookupCap_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s} \<inter> \<lbrace>(True \<longrightarrow> True) \<and> (\<not> True \<longrightarrow> False)\<rbrace>))}
 2. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. True \<and> invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>p. tptr \<notin> set (ksReadyQueues s p)))\<rbrace>
 3. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 4. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 5. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 6. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (6 subgoals):
 1. \<And>rv. \<Gamma>\<turnstile>\<^bsub>/?F1448 rv rv\<^esub> (?R'1448 rv rv) \<acute>lu_ret___struct_lookupCap_ret_C :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr tptr,rv) \<lbrace>lookupCap_ret_C.status_C \<acute>lu_ret___struct_lookupCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag (lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C)) \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned = capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C))) \<longrightarrow> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C))) \<longrightarrow> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C)) = 0 \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned = capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C))) \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))) \<and> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C)) = 0 \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C \<acute>lu_ret___struct_lookupCap_ret_C) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))\<rbrace>
 2. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. True \<and> invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>p. tptr \<notin> set (ksReadyQueues s p)))\<rbrace>
 3. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> ?R'1448 rv (handlerCPtr_' s)}
 4. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 5. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 6. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (5 subgoals):
 1. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. True \<and> invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>p. tptr \<notin> set (ksReadyQueues s p)))\<rbrace>
 2. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> \<lbrace>\<forall>t. lookupCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C) \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) \<noteq> 0 \<longrightarrow> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) \<noteq> 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) = 0 \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))) \<and> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) = 0 \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))\<rbrace>}
 3. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 4. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 5. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (5 subgoals):
 1. \<lbrace>?R816 (tcb_ptr_to_ctcb_ptr tptr)\<rbrace> threadGet tcbFaultHandler tptr \<lbrace>\<lambda>rv. (\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b))))\<rbrace>
 2. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> \<lbrace>\<forall>t. lookupCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C) \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) \<noteq> 0 \<longrightarrow> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) \<noteq> 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) = 0 \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))) \<and> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) = 0 \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))\<rbrace>}
 3. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 4. \<And>s. (tcb_at' tptr and ?R816 (tcb_ptr_to_ctcb_ptr tptr)) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 5. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ?R816 tptra) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (4 subgoals):
 1. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) {s. \<forall>rv. rv = handlerCPtr_' s \<longrightarrow> s \<in> {sa. cPtr_'_update (\<lambda>_. handlerCPtr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr tptr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = rv\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr tptr\<rbrace>} \<inter> \<lbrace>\<forall>t. lookupCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C) \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) \<noteq> 0 \<longrightarrow> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) \<noteq> 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) = 0 \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))) \<and> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) = 0 \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))\<rbrace>}
 2. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 3. \<And>s. (tcb_at' tptr and ((\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))))) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 4. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ((\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))))) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (4 subgoals):
 1. \<Gamma>\<turnstile>\<^bsub>/?F812\<^esub> ?R'812 Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr} (\<acute>handlerCPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr tptr\<rightarrow>[''tcbFaultHandler_C'']))) \<lbrace>\<forall>t. lookupCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C) \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) \<noteq> 0 \<longrightarrow> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) \<noteq> 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)) \<and> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) = 0 \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))) \<and> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C)) = 0 \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_lookupCap_ret_C) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>original_lookup_fault)))\<rbrace>
 2. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> ?R'812)
 3. \<And>s. (tcb_at' tptr and ((\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))))) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 4. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ((\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))))) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (3 subgoals):
 1. \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr)) \<acute>original_lookup_fault :== \<acute>current_lookup_fault (UNIV \<inter> {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr \<longrightarrow> (\<forall>t. lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<longrightarrow> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (original_lookup_fault_' s))) \<and> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (original_lookup_fault_' s)))) \<and> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (original_lookup_fault_' s)))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (original_lookup_fault_' s)))))})
 2. \<And>s. (tcb_at' tptr and ((\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))))) s \<Longrightarrow> \<Gamma>\<turnstile> (?Q'796 (tcb_ptr_to_ctcb_ptr tptr) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 3. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ((\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))))) s \<and> s' \<in> ?Q'796 tptra proof (prove)
goal (2 subgoals):
 1. \<And>s. (tcb_at' tptr and ((\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))))) s \<Longrightarrow> \<Gamma>\<turnstile> ({s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr \<longrightarrow> (\<forall>t. lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<longrightarrow> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s)))) \<and> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s))))) \<and> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s))))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s))))))} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>original_lookup_fault :== \<acute>current_lookup_fault {s'. (s, s') \<in> rf_sr}
 2. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ((\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))))) s \<and> s' \<in> {s. s \<Turnstile>\<^sub>c tptra \<longrightarrow> (\<forall>t. lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<longrightarrow> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s)))) \<and> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s))))) \<and> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s))))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s))))))} proof (prove)
goal (2 subgoals):
 1. \<And>s. (tcb_at' tptr and ((\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))))) s \<Longrightarrow> {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr tptr \<longrightarrow> (\<forall>t. lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<longrightarrow> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s)))) \<and> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s))))) \<and> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s))))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s))))))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (s, original_lookup_fault_'_update (\<lambda>_. current_lookup_fault_' (globals sa)) sa) \<in> rf_sr}
 2. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ((\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))))) s \<and> s' \<in> {s. s \<Turnstile>\<^sub>c tptra \<longrightarrow> (\<forall>t. lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<longrightarrow> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s)))) \<and> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s))))) \<and> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s))))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s))))))} proof (prove)
goal (1 subgoal):
 1. \<And>tptra s s'. \<lbrakk>tptra = tcb_ptr_to_ctcb_ptr tptr; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' tptr and sch_act_not tptr and (\<lambda>s. \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))) s; s' \<in> \<lbrace>cfault_rel (Some fault) (seL4_Fault_lift \<acute>current_fault) (lookup_fault_lift \<acute>current_lookup_fault)\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' tptr and ((\<lambda>s. invs' s \<and> tcb_at' tptr s) and (\<lambda>s. invs' s \<and> st_tcb_at' simple' tptr s \<and> sch_act_not tptr s \<and> valid_objs' s \<and> (\<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b)))))) s \<and> s' \<in> {s. s \<Turnstile>\<^sub>c tptra \<longrightarrow> (\<forall>t. lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<longrightarrow> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<longrightarrow> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s)))) \<and> (capCanGrant_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> (if capCanGrantReply_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) \<noteq> 0 then 1 else 0) = from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s))))) \<and> (capCanSend_CL (cap_endpoint_cap_lift (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t))) = 0 \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s))))) \<and> (cap_get_tag (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> from_bool (isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv)) = 0 \<longrightarrow> isEndpointCap rv \<and> capEPCanSend rv \<and> (capEPCanGrant rv \<or> capEPCanGrantReply rv) \<longrightarrow> cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s))) (lookup_fault_lift (current_lookup_fault_' (globals s))))))} proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; cfault_rel (Some fault) (seL4_Fault_lift (current_fault_' (globals s'))) (lookup_fault_lift (current_lookup_fault_' (globals s'))); invs' s; st_tcb_at' simple' tptr s; sch_act_not tptr s; \<forall>a b. tptr \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> tcb_at' tptr s \<and> valid_objs' s proof (prove)
goal:
No subgoals!