theory Ipc_C

lemma setMRs_syscall_error_ccorres:
  "ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_'
     (valid_pspace'
               and (case buf of None \<Rightarrow> \<top> | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)
               and (\<lambda>_. msg = snd (msgFromSyscallError err)))
           (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>
                 \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>
                 \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error
                          (lookup_fault_lift \<acute>current_lookup_fault)
                       = Some err\<rbrace>) hs
     (setMRs thread buf msg)
     (Call setMRs_syscall_error_'proc)"
  (is "ccorres ?r ret__unsigned_long_' ?P ?P' hs ?a ?c") apply (rule ccorres_gen_asm) apply (cinit') apply (rule_tac xf' = "\<lambda>s. current_syscall_error_' (globals s)"
                in ccorres_abstract) apply (rule ceqv_rules, rule rewrite_xfI,  simp,  rule ceqv_refl)+ apply (rule ceqv_refl) apply (rename_tac err') apply (rule_tac xf' = "\<lambda>s. current_lookup_fault_' (globals s)"
                in ccorres_abstract) apply (rule ceqv_rules, rule rewrite_xfI,  simp,  rule ceqv_refl)+ apply (rule ceqv_refl) apply (rename_tac luf') apply (rule_tac P="Some err = syscall_error_to_H err' (lookup_fault_lift luf')"
                in ccorres_gen_asm2) apply (rule_tac A="?P" and A'="?P'" in ccorres_guard_imp2) apply (simp add: setMRs_to_setMR del: Collect_const) apply (rule ccorres_stateAssert) apply (rule ccorres_Cond_rhs[rotated])+ apply (rule ccorres_inst[where P=\<top> and P'=UNIV]) apply simp apply (rule ccorres_inst[where P=\<top> and P'=UNIV]) apply (simp add: syscall_error_to_H_def) apply (simp_all add: syscall_error_to_H_def msgFromSyscallError_def
                               zipWithM_mapM mapM_Nil mapM_Cons
                               msgMaxLength_unfold zip_upt_Cons bind_assoc) apply (ctac add:setMR_ccorres) apply (rule ccorres_return_C,simp+)[1] apply (wp | (simp add: Collect_const_mem,
              vcg exspec=setMR_modifies exspec=setMRs_lookup_failure_modifies))+ apply (subgoal_tac "msg = []") apply (simp add: zipWithM_mapM mapM_Nil) apply (rule ccorres_return_C, simp+)[1] apply (simp split: if_split_asm) apply (subgoal_tac "err = FailedLookup (to_bool (failedLookupWasSource_C err'))
                                      (lookup_fault_to_H (the (lookup_fault_lift luf')))") apply (simp add: zip_upt_Cons mapM_Cons bind_assoc) apply (rule ccorres_rhs_assoc)+ apply (ctac add: setMR_ccorres_dc) apply (ctac add: setMRs_lookup_failure_ccorres[unfolded msgMaxLength_unfold]) apply (rule ccorres_return_C, simp+)[1] apply (wp hoare_case_option_wp
                | (simp add: Collect_const_mem,
                          vcg exspec=setMR_modifies exspec=setMRs_lookup_failure_modifies))+ apply (clarsimp simp: map_option_Some_eq2) apply (rule ccorres_return_C, simp+)[1] apply (rule ccorres_rhs_assoc
                 | (rule ccorres_inst, ctac add: setMR_ccorres_dc)
                 | (rule ccorres_inst, ctac add: setMR_ccorres)
                 | (rule ccorres_return_C, simp+)[1]
                 | wp hoare_case_option_wp
                 | (simp del: Collect_const, vcg exspec=setMR_modifies)
               )+ apply (simp add: msgMaxLength_unfold) apply (clarsimp split:if_split_asm simp:syscall_error_to_H_def map_option_Some_eq2) apply (simp add: msgFromLookupFailure_def
                 split: lookup_failure.split
            | simp add: to_bool_def split: if_split)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. msg = snd (msgFromSyscallError err))) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>) hs (setMRs thread buf msg) (Call setMRs_syscall_error_'proc) proof (prove)
goal (1 subgoal):
 1. msg = snd (msgFromSyscallError err) \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>) hs (setMRs thread buf msg) (Call setMRs_syscall_error_'proc) proof (prove)
goal (2 subgoals):
 1. msg = snd (msgFromSyscallError err) \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' ?Q359 ?Q'359 (SKIP # hs) (setMRs thread buf (snd (msgFromSyscallError err))) (IF type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_RangeError THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then 1 else 0));;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>receiveIPCBuffer,\<acute>current_lookup_fault,SCAST(32 signed \<rightarrow> 32) 1);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>s s'. \<lbrakk>msg = snd (msgFromSyscallError err); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> ?Q359 s \<and> s' \<in> ?Q'359 proof (prove)
goal (3 subgoals):
 1. \<And>rv' t t'. msg = snd (msgFromSyscallError err) \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_syscall_error_' (globals s)) rv' t t' (IF type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_RangeError THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then 1 else 0));;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>receiveIPCBuffer,\<acute>current_lookup_fault,SCAST(32 signed \<rightarrow> 32) 1);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C \<acute>current_syscall_error = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI) (?d'365 rv')
 2. \<And>rv'. msg = snd (msgFromSyscallError err) \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' ?Q359 (?G'365 rv') (SKIP # hs) (setMRs thread buf (snd (msgFromSyscallError err))) (?d'365 rv')
 3. \<And>s s'. \<lbrakk>msg = snd (msgFromSyscallError err); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> ?Q359 s \<and> s' \<in> {s. s \<in> ?G'365 (current_syscall_error_' (globals s))} proof (prove)
goal (3 subgoals):
 1. \<And>rv' t t'. msg = snd (msgFromSyscallError err) \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_syscall_error_' (globals s)) rv' t t' (Guard DontReach {} SKIP) (?b'469 rv')
 2. \<And>rv'. msg = snd (msgFromSyscallError err) \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' ?Q359 (?G'365 rv') (SKIP # hs) (setMRs thread buf (snd (msgFromSyscallError err))) (IF type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then 1 else 0));;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>receiveIPCBuffer,\<acute>current_lookup_fault,SCAST(32 signed \<rightarrow> 32) 1);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  ?b'469 rv'
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>s s'. \<lbrakk>msg = snd (msgFromSyscallError err); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> ?Q359 s \<and> s' \<in> {s. s \<in> ?G'365 (current_syscall_error_' (globals s))} proof (prove)
goal (2 subgoals):
 1. \<And>rv'. msg = snd (msgFromSyscallError err) \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' ?Q359 (?G'365 rv') (SKIP # hs) (setMRs thread buf (snd (msgFromSyscallError err))) (IF type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then 1 else 0));;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>receiveIPCBuffer,\<acute>current_lookup_fault,SCAST(32 signed \<rightarrow> 32) 1);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C rv' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>s s'. \<lbrakk>msg = snd (msgFromSyscallError err); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> ?Q359 s \<and> s' \<in> {s. s \<in> ?G'365 (current_syscall_error_' (globals s))} proof (prove)
goal (2 subgoals):
 1. \<And>err'. msg = snd (msgFromSyscallError err) \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' ?Q359 (?G'365 err') (SKIP # hs) (setMRs thread buf (snd (msgFromSyscallError err))) (IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then 1 else 0));;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>receiveIPCBuffer,\<acute>current_lookup_fault,SCAST(32 signed \<rightarrow> 32) 1);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>s s'. \<lbrakk>msg = snd (msgFromSyscallError err); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> ?Q359 s \<and> s' \<in> {s. s \<in> ?G'365 (current_syscall_error_' (globals s))} proof (prove)
goal (3 subgoals):
 1. \<And>err' rv' t t'. msg = snd (msgFromSyscallError err) \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_lookup_fault_' (globals s)) rv' t t' (IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then 1 else 0));;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>receiveIPCBuffer,\<acute>current_lookup_fault,SCAST(32 signed \<rightarrow> 32) 1);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI) (?d'480 err' rv')
 2. \<And>err' rv'. msg = snd (msgFromSyscallError err) \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' ?Q359 (?G'480 err' rv') (SKIP # hs) (setMRs thread buf (snd (msgFromSyscallError err))) (?d'480 err' rv')
 3. \<And>s s'. \<lbrakk>msg = snd (msgFromSyscallError err); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> ?Q359 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> ?G'480 (current_syscall_error_' (globals s)) (current_lookup_fault_' (globals sa))}} proof (prove)
goal (3 subgoals):
 1. \<And>err' rv' t t'. msg = snd (msgFromSyscallError err) \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_lookup_fault_' (globals s)) rv' t t' (Guard DontReach {} SKIP) (?b'584 err' rv')
 2. \<And>err' rv'. msg = snd (msgFromSyscallError err) \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' ?Q359 (?G'480 err' rv') (SKIP # hs) (setMRs thread buf (snd (msgFromSyscallError err))) (IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then 1 else 0));;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>receiveIPCBuffer,\<acute>current_lookup_fault,SCAST(32 signed \<rightarrow> 32) 1);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  ?b'584 err' rv'
FI
FI
FI
FI
FI
FI
FI
FI)
 3. \<And>s s'. \<lbrakk>msg = snd (msgFromSyscallError err); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> ?Q359 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> ?G'480 (current_syscall_error_' (globals s)) (current_lookup_fault_' (globals sa))}} proof (prove)
goal (2 subgoals):
 1. \<And>err' rv'. msg = snd (msgFromSyscallError err) \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' ?Q359 (?G'480 err' rv') (SKIP # hs) (setMRs thread buf (snd (msgFromSyscallError err))) (IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then 1 else 0));;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>receiveIPCBuffer,\<acute>current_lookup_fault,SCAST(32 signed \<rightarrow> 32) 1);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>s s'. \<lbrakk>msg = snd (msgFromSyscallError err); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> ?Q359 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> ?G'480 (current_syscall_error_' (globals s)) (current_lookup_fault_' (globals sa))}} proof (prove)
goal (2 subgoals):
 1. \<And>err' luf'. msg = snd (msgFromSyscallError err) \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' ?Q359 (?G'480 err' luf') (SKIP # hs) (setMRs thread buf (snd (msgFromSyscallError err))) (IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then 1 else 0));;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>receiveIPCBuffer,\<acute>current_lookup_fault,SCAST(32 signed \<rightarrow> 32) 1);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>s s'. \<lbrakk>msg = snd (msgFromSyscallError err); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> ?Q359 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> ?G'480 (current_syscall_error_' (globals s)) (current_lookup_fault_' (globals sa))}} proof (prove)
goal (2 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' ?Q359 (?G'595 err' luf') (SKIP # hs) (setMRs thread buf (snd (msgFromSyscallError err))) (IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then 1 else 0));;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>receiveIPCBuffer,\<acute>current_lookup_fault,SCAST(32 signed \<rightarrow> 32) 1);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>s s'. \<lbrakk>msg = snd (msgFromSyscallError err); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> ?Q359 s \<and> s' \<in> {s. s \<in> {sa. sa \<in> ?G'595 (current_syscall_error_' (globals s)) (current_lookup_fault_' (globals sa)) \<inter> \<lbrace>Some err = syscall_error_to_H \<^bsup>s\<^esup>current_syscall_error (lookup_fault_lift \<^bsup>sa\<^esup>current_lookup_fault)\<rbrace>}} proof (prove)
goal (3 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q596 err' luf') (?Q'596 err' luf') (SKIP # hs) (setMRs thread buf (snd (msgFromSyscallError err))) (IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup THEN
  CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then 1 else 0));;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>receiveIPCBuffer,\<acute>current_lookup_fault,SCAST(32 signed \<rightarrow> 32) 1);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,\<acute>receiveIPCBuffer,SCAST(32 signed \<rightarrow> 32) 0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>err' luf' s s'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. msg = snd (msgFromSyscallError err))) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> ?Q596 err' luf' s \<and> s' \<in> ?Q'596 err' luf'
 3. \<And>s s'. \<lbrakk>msg = snd (msgFromSyscallError err); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. msg = snd (msgFromSyscallError err))) s \<and> s' \<in> {s. s \<in> {sa. sa \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace> \<inter> \<lbrace>Some err = syscall_error_to_H \<^bsup>s\<^esup>current_syscall_error (lookup_fault_lift \<^bsup>sa\<^esup>current_lookup_fault)\<rbrace>}} proof (prove)
goal (3 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q596 err' luf') (?Q'596 err' luf') (SKIP # hs) (do y <- stateAssert (tcb_at' thread) [];
ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError THEN
  CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup THEN
  CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>err' luf' s s'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. msg = snd (msgFromSyscallError err))) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> ?Q596 err' luf' s \<and> s' \<in> ?Q'596 err' luf'
 3. \<And>s s'. \<lbrakk>msg = snd (msgFromSyscallError err); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. msg = snd (msgFromSyscallError err))) s \<and> s' \<in> {s. s \<in> {sa. sa \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace> \<inter> \<lbrace>Some err = syscall_error_to_H \<^bsup>s\<^esup>current_syscall_error (lookup_fault_lift \<^bsup>sa\<^esup>current_lookup_fault)\<rbrace>}} proof (prove)
goal (3 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?P603 err' luf') (?Q'596 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError THEN
  CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup THEN
  CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. 0)
ELSE
  IF type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory THEN
  \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI
FI
FI)
 2. \<And>err' luf' s s'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. msg = snd (msgFromSyscallError err))) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> ?P603 err' luf' s) \<and> s' \<in> ?Q'596 err' luf'
 3. \<And>s s'. \<lbrakk>msg = snd (msgFromSyscallError err); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. msg = snd (msgFromSyscallError err))) s \<and> s' \<in> {s. s \<in> {sa. sa \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace> \<inter> \<lbrace>Some err = syscall_error_to_H \<^bsup>s\<^esup>current_syscall_error (lookup_fault_lift \<^bsup>sa\<^esup>current_lookup_fault)\<rbrace>}} proof (prove)
goal (11 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; \<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R626 err' luf') (?T626 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (Guard DontReach {} SKIP)
 2. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; \<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q626 err' luf') (?S626 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 3. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q623 err' luf') (?S623 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 4. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q620 err' luf') (?S620 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 5. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 6. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 7. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 8. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 9. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 10. \<And>err' luf' s s'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. msg = snd (msgFromSyscallError err))) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> ?Q620 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> ?Q623 err' luf' s) \<and> (\<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> ?Q626 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> ?R626 err' luf' s))))))))) \<and> s' \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s \<in> ?S620 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s \<in> ?S623 err' luf') \<and> (\<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s \<in> ?S626 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s \<in> ?T626 err' luf')})})})})})})})}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; \<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (Guard DontReach {} SKIP)
 2. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; \<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q626 err' luf') (?S626 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 3. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q623 err' luf') (?S623 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 4. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q620 err' luf') (?S620 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 5. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 6. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 7. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 8. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 9. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 10. \<And>err' luf' s s'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. msg = snd (msgFromSyscallError err))) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> ?Q620 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> ?Q623 err' luf' s) \<and> (\<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> ?Q626 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> True))))))))) \<and> s' \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s \<in> ?S620 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s \<in> ?S623 err' luf') \<and> (\<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s \<in> ?S626 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s \<in> UNIV)})})})})})})})}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (Guard DontReach {} SKIP)
 2. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; \<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q626 err' luf') (?S626 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 3. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q623 err' luf') (?S623 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 4. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q620 err' luf') (?S620 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 5. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 6. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 7. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 8. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 9. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 10. \<And>err' luf' s s'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. msg = snd (msgFromSyscallError err))) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> ?Q620 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> ?Q623 err' luf' s) \<and> (\<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> ?Q626 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> True))))))))) \<and> s' \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s \<in> ?S620 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s \<in> ?S623 err' luf') \<and> (\<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s \<in> ?S626 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s \<in> UNIV)})})})})})})})}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (Guard DontReach {} SKIP)
 2. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; \<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q626 err' luf') (?S626 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 3. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q623 err' luf') (?S623 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 4. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q620 err' luf') (?S620 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 5. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 6. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 7. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 8. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 9. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 10. \<And>err' luf' s s'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. msg = snd (msgFromSyscallError err))) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> ?Q620 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> ?Q623 err' luf' s) \<and> (\<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> ?Q626 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> True))))))))) \<and> s' \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s \<in> ?S620 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s \<in> ?S623 err' luf') \<and> (\<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s \<in> ?S626 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s \<in> UNIV)})})})})})})})}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; \<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q626 err' luf') (?S626 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 2. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q623 err' luf') (?S623 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 3. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q620 err' luf') (?S620 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 4. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 5. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 6. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 7. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 8. \<And>err' luf'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do ys <- zipWithM (setMR thread buf) [0..<msgMaxLength] (snd (msgFromSyscallError err));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 9. \<And>err' luf' s s'. \<lbrakk>msg = snd (msgFromSyscallError err); Some err = syscall_error_to_H err' (lookup_fault_lift luf'); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. msg = snd (msgFromSyscallError err))) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> ?Q620 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> ?Q623 err' luf' s) \<and> (\<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> ?Q626 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> True))))))))) \<and> s' \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s \<in> ?S620 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s \<in> ?S623 err' luf') \<and> (\<not> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<longrightarrow> s \<in> {s. (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s \<in> ?S626 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s \<in> UNIV)})})})})})})})}
 10. \<And>s s'. \<lbrakk>msg = snd (msgFromSyscallError err); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. msg = snd (msgFromSyscallError err))) s \<and> s' \<in> {s. s \<in> {sa. sa \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>syscall_error_to_H \<acute>current_syscall_error (lookup_fault_lift \<acute>current_lookup_fault) = Some err\<rbrace> \<inter> \<lbrace>Some err = syscall_error_to_H \<^bsup>s\<^esup>current_syscall_error (lookup_fault_lift \<^bsup>sa\<^esup>current_lookup_fault)\<rbrace>}} proof (prove)
goal (9 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = [memoryLeft_C err']; err = Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err'); seL4_NotEnoughMemory \<noteq> seL4_InvalidArgument; seL4_NotEnoughMemory \<noteq> seL4_InvalidCapability; seL4_NotEnoughMemory \<noteq> seL4_IllegalOperation; seL4_NotEnoughMemory \<noteq> seL4_RangeError; seL4_NotEnoughMemory \<noteq> seL4_AlignmentError; seL4_NotEnoughMemory \<noteq> seL4_FailedLookup; seL4_NotEnoughMemory \<noteq> seL4_RevokeFirst \<and> seL4_NotEnoughMemory \<noteq> seL4_DeleteFirst \<and> seL4_NotEnoughMemory \<noteq> seL4_TruncatedMessage; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q626 err' luf') (?S626 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (memoryLeft_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,memoryLeft_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 2. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q623 err' luf') (?S623 err' luf') (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [0..<120] (snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, []))));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 3. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q620 err' luf') (?S620 err' luf') (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [0..<120] (snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, []))));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 4. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.AlignmentError; seL4_AlignmentError \<noteq> seL4_InvalidArgument; seL4_AlignmentError \<noteq> seL4_InvalidCapability; seL4_AlignmentError \<noteq> seL4_IllegalOperation; seL4_AlignmentError \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 5. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 6. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 7. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 8. \<And>err' luf'. \<lbrakk>msg = [invalidArgumentNumber_C err']; err = Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err')); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidArgumentNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 9. \<And>err' luf' s s'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); (s, s') \<in> rf_sr; valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread \<and> receiveIPCBuffer_' s' = option_to_ptr buf \<and> (if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C (current_syscall_error_' (globals s'))) (rangeErrorMax_C (current_syscall_error_' (globals s')))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s')))) \<circ> lookup_fault_to_H) (lookup_fault_lift (current_lookup_fault_' (globals s'))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C (current_syscall_error_' (globals s')))) else None) = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None)\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> ?Q620 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> ?Q623 err' luf' s) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> ?Q623 err' luf' s) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> ?Q623 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> ?Q626 err' luf' s)))))))) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s' \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s' \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s' \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s' \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s' \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s' \<in> ?S620 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> s' \<in> ?S623 err' luf') \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> s' \<in> ?S623 err' luf') \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s' \<in> ?S623 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s' \<in> ?S626 err' luf'))))))) proof (prove)
goal (11 subgoals):
 1. \<And>err' luf' rv ret__unsigned. \<lbrakk>msg = [memoryLeft_C err']; err = Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err'); seL4_NotEnoughMemory \<noteq> seL4_InvalidArgument; seL4_NotEnoughMemory \<noteq> seL4_InvalidCapability; seL4_NotEnoughMemory \<noteq> seL4_IllegalOperation; seL4_NotEnoughMemory \<noteq> seL4_RangeError; seL4_NotEnoughMemory \<noteq> seL4_AlignmentError; seL4_NotEnoughMemory \<noteq> seL4_FailedLookup; seL4_NotEnoughMemory \<noteq> seL4_RevokeFirst \<and> seL4_NotEnoughMemory \<noteq> seL4_DeleteFirst \<and> seL4_NotEnoughMemory \<noteq> seL4_TruncatedMessage; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory; rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q646 err' luf' rv) (?Q'646 err' luf' rv ret__unsigned) (SKIP # hs) (return (word_of_nat rv)) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned))
 2. \<And>err' luf'. \<lbrakk>msg = [memoryLeft_C err']; err = Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err'); seL4_NotEnoughMemory \<noteq> seL4_InvalidArgument; seL4_NotEnoughMemory \<noteq> seL4_InvalidCapability; seL4_NotEnoughMemory \<noteq> seL4_IllegalOperation; seL4_NotEnoughMemory \<noteq> seL4_RangeError; seL4_NotEnoughMemory \<noteq> seL4_AlignmentError; seL4_NotEnoughMemory \<noteq> seL4_FailedLookup; seL4_NotEnoughMemory \<noteq> seL4_RevokeFirst \<and> seL4_NotEnoughMemory \<noteq> seL4_DeleteFirst \<and> seL4_NotEnoughMemory \<noteq> seL4_TruncatedMessage; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory\<rbrakk> \<Longrightarrow> \<lbrace>?R646 err' luf'\<rbrace> setMR thread buf 0 (memoryLeft_C err') \<lbrace>?Q646 err' luf'\<rbrace>
 3. \<And>err' luf'. \<lbrakk>msg = [memoryLeft_C err']; err = Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err'); seL4_NotEnoughMemory \<noteq> seL4_InvalidArgument; seL4_NotEnoughMemory \<noteq> seL4_InvalidCapability; seL4_NotEnoughMemory \<noteq> seL4_IllegalOperation; seL4_NotEnoughMemory \<noteq> seL4_RangeError; seL4_NotEnoughMemory \<noteq> seL4_AlignmentError; seL4_NotEnoughMemory \<noteq> seL4_FailedLookup; seL4_NotEnoughMemory \<noteq> seL4_RevokeFirst \<and> seL4_NotEnoughMemory \<noteq> seL4_DeleteFirst \<and> seL4_NotEnoughMemory \<noteq> seL4_TruncatedMessage; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'646 err' luf') \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,memoryLeft_C \<acute>current_syscall_error) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'646 err' luf' rv (ret__unsigned_' s)}
 4. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q623 err' luf') (?S623 err' luf') (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [0..<120] (snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, []))));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 5. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q620 err' luf') (?S620 err' luf') (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [0..<120] (snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, []))));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 6. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.AlignmentError; seL4_AlignmentError \<noteq> seL4_InvalidArgument; seL4_AlignmentError \<noteq> seL4_InvalidCapability; seL4_AlignmentError \<noteq> seL4_IllegalOperation; seL4_AlignmentError \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 7. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 8. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 9. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 10. \<And>err' luf'. \<lbrakk>msg = [invalidArgumentNumber_C err']; err = Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err')); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidArgumentNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = [memoryLeft_C err']; err = Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err'); seL4_NotEnoughMemory \<noteq> seL4_InvalidArgument; seL4_NotEnoughMemory \<noteq> seL4_InvalidCapability; seL4_NotEnoughMemory \<noteq> seL4_IllegalOperation; seL4_NotEnoughMemory \<noteq> seL4_RangeError; seL4_NotEnoughMemory \<noteq> seL4_AlignmentError; seL4_NotEnoughMemory \<noteq> seL4_FailedLookup; seL4_NotEnoughMemory \<noteq> seL4_RevokeFirst \<and> seL4_NotEnoughMemory \<noteq> seL4_DeleteFirst \<and> seL4_NotEnoughMemory \<noteq> seL4_TruncatedMessage; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory\<rbrakk> \<Longrightarrow> \<lbrace>?R646 err' luf'\<rbrace> setMR thread buf 0 (memoryLeft_C err') \<lbrace>\<lambda>rv _. True\<rbrace>
 2. \<And>err' luf'. \<lbrakk>msg = [memoryLeft_C err']; err = Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err'); seL4_NotEnoughMemory \<noteq> seL4_InvalidArgument; seL4_NotEnoughMemory \<noteq> seL4_InvalidCapability; seL4_NotEnoughMemory \<noteq> seL4_IllegalOperation; seL4_NotEnoughMemory \<noteq> seL4_RangeError; seL4_NotEnoughMemory \<noteq> seL4_AlignmentError; seL4_NotEnoughMemory \<noteq> seL4_FailedLookup; seL4_NotEnoughMemory \<noteq> seL4_RevokeFirst \<and> seL4_NotEnoughMemory \<noteq> seL4_DeleteFirst \<and> seL4_NotEnoughMemory \<noteq> seL4_TruncatedMessage; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'646 err' luf') \<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,memoryLeft_C \<acute>current_syscall_error) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> \<lbrace>word_of_nat rv = \<^bsup>s\<^esup>ret__unsigned && mask msgLengthBits\<rbrace>}
 3. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q623 err' luf') (?S623 err' luf') (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [0..<120] (snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, []))));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 4. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q620 err' luf') (?S620 err' luf') (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [0..<120] (snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, []))));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 5. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.AlignmentError; seL4_AlignmentError \<noteq> seL4_InvalidArgument; seL4_AlignmentError \<noteq> seL4_InvalidCapability; seL4_AlignmentError \<noteq> seL4_IllegalOperation; seL4_AlignmentError \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 6. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 7. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 8. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 9. \<And>err' luf'. \<lbrakk>msg = [invalidArgumentNumber_C err']; err = Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err')); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidArgumentNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 10. \<And>err' luf' s s'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); (s, s') \<in> rf_sr; valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread \<and> receiveIPCBuffer_' s' = option_to_ptr buf \<and> (if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C (current_syscall_error_' (globals s'))) (rangeErrorMax_C (current_syscall_error_' (globals s')))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s')))) \<circ> lookup_fault_to_H) (lookup_fault_lift (current_lookup_fault_' (globals s'))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C (current_syscall_error_' (globals s')))) else None) = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None)\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> ?Q620 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> ?Q623 err' luf' s) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> ?Q623 err' luf' s) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> ?Q623 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and ?R646 err' luf') s)))))))) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s' \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s' \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s' \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s' \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s' \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s' \<in> ?S620 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> s' \<in> ?S623 err' luf') \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> s' \<in> ?S623 err' luf') \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s' \<in> ?S623 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. memoryLeft_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = memoryLeft_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'646 err' luf'))))))) proof (prove)
goal (8 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q623 err' luf') (?S623 err' luf') (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [0..<120] (snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, []))));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 2. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q620 err' luf') (?S620 err' luf') (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [0..<120] (snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, []))));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 3. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.AlignmentError; seL4_AlignmentError \<noteq> seL4_InvalidArgument; seL4_AlignmentError \<noteq> seL4_InvalidCapability; seL4_AlignmentError \<noteq> seL4_IllegalOperation; seL4_AlignmentError \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 4. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 5. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 6. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 7. \<And>err' luf'. \<lbrakk>msg = [invalidArgumentNumber_C err']; err = Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err')); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidArgumentNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 8. \<And>err' luf' s s'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); (s, s') \<in> rf_sr; valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread \<and> receiveIPCBuffer_' s' = option_to_ptr buf \<and> (if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C (current_syscall_error_' (globals s'))) (rangeErrorMax_C (current_syscall_error_' (globals s')))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s')))) \<circ> lookup_fault_to_H) (lookup_fault_lift (current_lookup_fault_' (globals s'))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C (current_syscall_error_' (globals s')))) else None) = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None)\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> ?Q620 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> ?Q623 err' luf' s) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> ?Q623 err' luf' s) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> ?Q623 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>_. True)) s)))))))) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s' \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s' \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s' \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s' \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s' \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s' \<in> ?S620 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> s' \<in> ?S623 err' luf') \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> s' \<in> ?S623 err' luf') \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s' \<in> ?S623 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. memoryLeft_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = memoryLeft_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>))))))) proof (prove)
goal (9 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage; msg = []\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q623 err' luf') (?S623 err' luf') (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [0..<120] (snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, []))));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 2. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage\<rbrakk> \<Longrightarrow> msg = []
 3. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q620 err' luf') (?S620 err' luf') (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [0..<120] (snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, []))));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 4. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.AlignmentError; seL4_AlignmentError \<noteq> seL4_InvalidArgument; seL4_AlignmentError \<noteq> seL4_InvalidCapability; seL4_AlignmentError \<noteq> seL4_IllegalOperation; seL4_AlignmentError \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 5. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 6. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 7. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 8. \<And>err' luf'. \<lbrakk>msg = [invalidArgumentNumber_C err']; err = Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err')); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidArgumentNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 9. \<And>err' luf' s s'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); (s, s') \<in> rf_sr; valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread \<and> receiveIPCBuffer_' s' = option_to_ptr buf \<and> (if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C (current_syscall_error_' (globals s'))) (rangeErrorMax_C (current_syscall_error_' (globals s')))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s')))) \<circ> lookup_fault_to_H) (lookup_fault_lift (current_lookup_fault_' (globals s'))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C (current_syscall_error_' (globals s')))) else None) = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None)\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> ?Q620 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> ?Q623 err' luf' s) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> ?Q623 err' luf' s) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> ?Q623 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>_. True)) s)))))))) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s' \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s' \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s' \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s' \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s' \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s' \<in> ?S620 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> s' \<in> ?S623 err' luf') \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> s' \<in> ?S623 err' luf') \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s' \<in> ?S623 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. memoryLeft_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = memoryLeft_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>))))))) proof (prove)
goal (9 subgoals):
 1. \<And>err' luf'. \<lbrakk>[] = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage; msg = []\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q623 err' luf') (?S623 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 2. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage\<rbrakk> \<Longrightarrow> msg = []
 3. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q620 err' luf') (?S620 err' luf') (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [0..<120] (snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, []))));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 4. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.AlignmentError; seL4_AlignmentError \<noteq> seL4_InvalidArgument; seL4_AlignmentError \<noteq> seL4_InvalidCapability; seL4_AlignmentError \<noteq> seL4_IllegalOperation; seL4_AlignmentError \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 5. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 6. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 7. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 8. \<And>err' luf'. \<lbrakk>msg = [invalidArgumentNumber_C err']; err = Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err')); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidArgumentNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 9. \<And>err' luf' s s'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); (s, s') \<in> rf_sr; valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread \<and> receiveIPCBuffer_' s' = option_to_ptr buf \<and> (if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C (current_syscall_error_' (globals s'))) (rangeErrorMax_C (current_syscall_error_' (globals s')))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s')))) \<circ> lookup_fault_to_H) (lookup_fault_lift (current_lookup_fault_' (globals s'))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C (current_syscall_error_' (globals s')))) else None) = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None)\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> ?Q620 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> ?Q623 err' luf' s) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> ?Q623 err' luf' s) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> ?Q623 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>_. True)) s)))))))) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s' \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s' \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s' \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s' \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s' \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s' \<in> ?S620 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> s' \<in> ?S623 err' luf') \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> s' \<in> ?S623 err' luf') \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s' \<in> ?S623 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. memoryLeft_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = memoryLeft_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>))))))) proof (prove)
goal (8 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError; type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<or> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage\<rbrakk> \<Longrightarrow> msg = []
 2. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q620 err' luf') (?S620 err' luf') (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [0..<120] (snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, []))));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 3. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.AlignmentError; seL4_AlignmentError \<noteq> seL4_InvalidArgument; seL4_AlignmentError \<noteq> seL4_InvalidCapability; seL4_AlignmentError \<noteq> seL4_IllegalOperation; seL4_AlignmentError \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 4. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 5. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 6. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 7. \<And>err' luf'. \<lbrakk>msg = [invalidArgumentNumber_C err']; err = Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err')); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidArgumentNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 8. \<And>err' luf' s s'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); (s, s') \<in> rf_sr; valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread \<and> receiveIPCBuffer_' s' = option_to_ptr buf \<and> (if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C (current_syscall_error_' (globals s'))) (rangeErrorMax_C (current_syscall_error_' (globals s')))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s')))) \<circ> lookup_fault_to_H) (lookup_fault_lift (current_lookup_fault_' (globals s'))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C (current_syscall_error_' (globals s')))) else None) = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None)\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> ?Q620 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> True) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>_. True)) s)))))))) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s' \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s' \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s' \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s' \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s' \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s' \<in> ?S620 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. memoryLeft_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = memoryLeft_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>))))))) proof (prove)
goal (7 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q620 err' luf') (?S620 err' luf') (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [0..<120] (snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, []))));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 2. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.AlignmentError; seL4_AlignmentError \<noteq> seL4_InvalidArgument; seL4_AlignmentError \<noteq> seL4_InvalidCapability; seL4_AlignmentError \<noteq> seL4_IllegalOperation; seL4_AlignmentError \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 3. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 4. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 5. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 6. \<And>err' luf'. \<lbrakk>msg = [invalidArgumentNumber_C err']; err = Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err')); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidArgumentNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 7. \<And>err' luf' s s'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); (s, s') \<in> rf_sr; valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread \<and> receiveIPCBuffer_' s' = option_to_ptr buf \<and> (if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C (current_syscall_error_' (globals s'))) (rangeErrorMax_C (current_syscall_error_' (globals s')))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s')))) \<circ> lookup_fault_to_H) (lookup_fault_lift (current_lookup_fault_' (globals s'))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C (current_syscall_error_' (globals s')))) else None) = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None)\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> ?Q620 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> True) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>_. True)) s)))))))) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s' \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s' \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s' \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s' \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s' \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s' \<in> ?S620 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. memoryLeft_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = memoryLeft_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>))))))) proof (prove)
goal (8 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q620 err' luf') (?S620 err' luf') (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [0..<120] (snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, []))));
return (word_of_nat (if ys = [] then 0 else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 2. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))
 3. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.AlignmentError; seL4_AlignmentError \<noteq> seL4_InvalidArgument; seL4_AlignmentError \<noteq> seL4_InvalidCapability; seL4_AlignmentError \<noteq> seL4_IllegalOperation; seL4_AlignmentError \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 4. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 5. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 6. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 7. \<And>err' luf'. \<lbrakk>msg = [invalidArgumentNumber_C err']; err = Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err')); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidArgumentNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 8. \<And>err' luf' s s'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); (s, s') \<in> rf_sr; valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread \<and> receiveIPCBuffer_' s' = option_to_ptr buf \<and> (if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C (current_syscall_error_' (globals s'))) (rangeErrorMax_C (current_syscall_error_' (globals s')))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s')))) \<circ> lookup_fault_to_H) (lookup_fault_lift (current_lookup_fault_' (globals s'))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C (current_syscall_error_' (globals s')))) else None) = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None)\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> ?Q620 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> True) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>_. True)) s)))))))) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s' \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s' \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s' \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s' \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s' \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s' \<in> ?S620 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. memoryLeft_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = memoryLeft_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>))))))) proof (prove)
goal (8 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) # msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf'))); Some (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))) = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q620 err' luf') (?S620 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))));
ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [Suc 0..<120] (msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf')))));
return (word_of_nat (if ys = [] then y else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 2. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))
 3. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.AlignmentError; seL4_AlignmentError \<noteq> seL4_InvalidArgument; seL4_AlignmentError \<noteq> seL4_InvalidCapability; seL4_AlignmentError \<noteq> seL4_IllegalOperation; seL4_AlignmentError \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 4. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 5. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 6. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 7. \<And>err' luf'. \<lbrakk>msg = [invalidArgumentNumber_C err']; err = Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err')); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidArgumentNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 8. \<And>err' luf' s s'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); (s, s') \<in> rf_sr; valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread \<and> receiveIPCBuffer_' s' = option_to_ptr buf \<and> (if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C (current_syscall_error_' (globals s'))) (rangeErrorMax_C (current_syscall_error_' (globals s')))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s')))) \<circ> lookup_fault_to_H) (lookup_fault_lift (current_lookup_fault_' (globals s'))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C (current_syscall_error_' (globals s')))) else None) = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None)\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> ?Q620 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> True) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>_. True)) s)))))))) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s' \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s' \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s' \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s' \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s' \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s' \<in> ?S620 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. memoryLeft_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = memoryLeft_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>))))))) proof (prove)
goal (8 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) # msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf'))); Some (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))) = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q620 err' luf') (?S620 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))));
ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [Suc 0..<120] (msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf')))));
return (word_of_nat (if ys = [] then y else last ys))
od) (CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_'))
 2. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))
 3. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.AlignmentError; seL4_AlignmentError \<noteq> seL4_InvalidArgument; seL4_AlignmentError \<noteq> seL4_InvalidCapability; seL4_AlignmentError \<noteq> seL4_IllegalOperation; seL4_AlignmentError \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 4. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 5. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 6. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 7. \<And>err' luf'. \<lbrakk>msg = [invalidArgumentNumber_C err']; err = Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err')); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidArgumentNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 8. \<And>err' luf' s s'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); (s, s') \<in> rf_sr; valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread \<and> receiveIPCBuffer_' s' = option_to_ptr buf \<and> (if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C (current_syscall_error_' (globals s'))) (rangeErrorMax_C (current_syscall_error_' (globals s')))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s')))) \<circ> lookup_fault_to_H) (lookup_fault_lift (current_lookup_fault_' (globals s'))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C (current_syscall_error_' (globals s')))) else None) = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None)\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> ?Q620 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> True) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>_. True)) s)))))))) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s' \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s' \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s' \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s' \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s' \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s' \<in> ?S620 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. memoryLeft_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = memoryLeft_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>))))))) proof (prove)
goal (10 subgoals):
 1. \<And>err' luf' rv xfdc. \<lbrakk>msg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) # msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf'))); Some (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))) = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf'))); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q755 err' luf' rv) (?Q'755 err' luf' rv xfdc) (SKIP # hs) (do ys <- mapM (\<lambda>(x, y). setMR thread buf x y) (zip [Suc 0..<120] (msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf')))));
return (word_of_nat (if ys = [] then rv else last ys))
od) (\<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 2. \<And>err' luf'. \<lbrakk>msg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) # msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf'))); Some (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))) = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))\<rbrakk> \<Longrightarrow> \<lbrace>?R755 err' luf'\<rbrace> setMR thread buf 0 (word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err')))) \<lbrace>?Q755 err' luf'\<rbrace>
 3. \<And>err' luf'. \<lbrakk>msg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) # msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf'))); Some (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))) = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'755 err' luf') CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'755 err' luf' rv (xfdc s)}
 4. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))
 5. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.AlignmentError; seL4_AlignmentError \<noteq> seL4_InvalidArgument; seL4_AlignmentError \<noteq> seL4_InvalidCapability; seL4_AlignmentError \<noteq> seL4_IllegalOperation; seL4_AlignmentError \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 6. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 7. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 8. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 9. \<And>err' luf'. \<lbrakk>msg = [invalidArgumentNumber_C err']; err = Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err')); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidArgumentNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 10. \<And>err' luf' s s'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); (s, s') \<in> rf_sr; valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread \<and> receiveIPCBuffer_' s' = option_to_ptr buf \<and> (if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C (current_syscall_error_' (globals s'))) (rangeErrorMax_C (current_syscall_error_' (globals s')))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s')))) \<circ> lookup_fault_to_H) (lookup_fault_lift (current_lookup_fault_' (globals s'))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C (current_syscall_error_' (globals s')))) else None) = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None)\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and ?R755 err' luf') s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> True) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>_. True)) s)))))))) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s' \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s' \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s' \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s' \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s' \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. if failedLookupWasSource_C (current_syscall_error_' (globals s)) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err')))\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'755 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. memoryLeft_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = memoryLeft_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>))))))) proof (prove)
goal (12 subgoals):
 1. \<And>err' luf' rv xfdc rva ret__unsigned. \<lbrakk>msg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) # msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf'))); Some (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))) = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf'))); dc rv xfdc; rva \<noteq> [] \<and> last rva = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q789 err' luf' rv xfdc rva) (?Q'789 err' luf' rv xfdc rva ret__unsigned) (SKIP # hs) (return (word_of_nat (if rva = [] then rv else last rva))) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned))
 2. \<And>err' luf' rv xfdc. \<lbrakk>msg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) # msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf'))); Some (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))) = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf'))); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R791 err' luf' rv\<rbrace> mapM (\<lambda>(x, y). setMR thread buf x y) (zip [Suc 0..<120] (msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf'))))) \<lbrace>?Q789 err' luf' rv xfdc\<rbrace>
 3. \<And>err' luf' rv xfdc. \<lbrakk>msg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) # msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf'))); Some (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))) = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf'))); dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'789 err' luf' rv xfdc) \<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1) {s. \<forall>rva. rva \<noteq> [] \<and> last rva = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'789 err' luf' rv xfdc rva (ret__unsigned_' s)}
 4. \<And>err' luf'. \<lbrakk>msg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) # msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf'))); Some (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))) = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))\<rbrakk> \<Longrightarrow> \<lbrace>?R755 err' luf'\<rbrace> setMR thread buf 0 (word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err')))) \<lbrace>\<lambda>rv. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. Suc 0 + length (msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf')))) < 120) and ?R791 err' luf' rv\<rbrace>
 5. \<And>err' luf'. \<lbrakk>msg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) # msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf'))); Some (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))) = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'755 err' luf') CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. offset_'_update (\<lambda>_. 1) (luf_'_update (\<lambda>_. current_lookup_fault_' (globals s)) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>map_option lookup_fault_to_H (lookup_fault_lift \<acute>luf) = Some (lookup_fault_to_H (the (lookup_fault_lift luf')))\<rbrace> \<inter> \<lbrace>Suc 0 = unat \<acute>offset\<rbrace>} \<inter> ?R'789 err' luf' rv (xfdc s)}
 6. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))
 7. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.AlignmentError; seL4_AlignmentError \<noteq> seL4_InvalidArgument; seL4_AlignmentError \<noteq> seL4_InvalidCapability; seL4_AlignmentError \<noteq> seL4_IllegalOperation; seL4_AlignmentError \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 8. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 9. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 10. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>err' luf' rv xfdc. \<lbrakk>msg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) # msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf'))); Some (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))) = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf'))); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R791 err' luf' rv\<rbrace> mapM (\<lambda>(x, y). setMR thread buf x y) (zip [Suc 0..<120] (msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf'))))) \<lbrace>\<lambda>rva _. True\<rbrace>
 2. \<And>err' luf' rv xfdc. \<lbrakk>msg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) # msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf'))); Some (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))) = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf'))); dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'789 err' luf' rv xfdc) \<acute>ret__unsigned :== CALL setMRs_lookup_failure_'proc(\<acute>thread,\<acute>current_lookup_fault,1) {s. \<forall>rva. rva \<noteq> [] \<and> last rva = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> \<lbrace>word_of_nat (if rva = [] then rv else last rva) = \<^bsup>s\<^esup>ret__unsigned && mask msgLengthBits\<rbrace>}
 3. \<And>err' luf'. \<lbrakk>msg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) # msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf'))); Some (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))) = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))\<rbrakk> \<Longrightarrow> \<lbrace>?R755 err' luf'\<rbrace> setMR thread buf 0 (word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err')))) \<lbrace>\<lambda>rv. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. Suc 0 + length (msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf')))) < 120) and ?R791 err' luf' rv\<rbrace>
 4. \<And>err' luf'. \<lbrakk>msg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) # msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf'))); Some (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))) = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'755 err' luf') CALL setMR_'proc(\<acute>thread,0,if failedLookupWasSource_C \<acute>current_syscall_error \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. offset_'_update (\<lambda>_. 1) (luf_'_update (\<lambda>_. current_lookup_fault_' (globals s)) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>map_option lookup_fault_to_H (lookup_fault_lift \<acute>luf) = Some (lookup_fault_to_H (the (lookup_fault_lift luf')))\<rbrace> \<inter> \<lbrace>Suc 0 = unat \<acute>offset\<rbrace>} \<inter> ?R'789 err' luf' rv (xfdc s)}
 5. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))
 6. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.AlignmentError; seL4_AlignmentError \<noteq> seL4_InvalidArgument; seL4_AlignmentError \<noteq> seL4_InvalidCapability; seL4_AlignmentError \<noteq> seL4_IllegalOperation; seL4_AlignmentError \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 7. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 8. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 9. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 10. \<And>err' luf'. \<lbrakk>msg = [invalidArgumentNumber_C err']; err = Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err')); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidArgumentNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
A total of 11 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf'); seL4_FailedLookup \<noteq> seL4_InvalidArgument; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_RangeError; seL4_FailedLookup \<noteq> seL4_AlignmentError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup\<rbrakk> \<Longrightarrow> err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H (the (lookup_fault_lift luf')))
 2. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.AlignmentError; seL4_AlignmentError \<noteq> seL4_InvalidArgument; seL4_AlignmentError \<noteq> seL4_InvalidCapability; seL4_AlignmentError \<noteq> seL4_IllegalOperation; seL4_AlignmentError \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 3. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 4. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 5. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 6. \<And>err' luf'. \<lbrakk>msg = [invalidArgumentNumber_C err']; err = Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err')); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidArgumentNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 7. \<And>err' luf' s s'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); (s, s') \<in> rf_sr; valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread \<and> receiveIPCBuffer_' s' = option_to_ptr buf \<and> (if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C (current_syscall_error_' (globals s'))) (rangeErrorMax_C (current_syscall_error_' (globals s')))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s')))) \<circ> lookup_fault_to_H) (lookup_fault_lift (current_lookup_fault_' (globals s'))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C (current_syscall_error_' (globals s')))) else None) = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None)\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc 0 + length (msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf')))) < 120 \<and> True)) s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> True) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>_. True)) s)))))))) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s' \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s' \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s' \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s' \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s' \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. if failedLookupWasSource_C (current_syscall_error_' (globals s)) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err')))\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread \<and> \<acute>receiveIPCBuffer = option_to_ptr buf \<and> (\<exists>z. lookup_fault_lift \<acute>current_lookup_fault = Some z \<and> lookup_fault_to_H z = lookup_fault_to_H (the (lookup_fault_lift luf')))\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. memoryLeft_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = memoryLeft_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>))))))) proof (prove)
goal (6 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.AlignmentError; seL4_AlignmentError \<noteq> seL4_InvalidArgument; seL4_AlignmentError \<noteq> seL4_InvalidCapability; seL4_AlignmentError \<noteq> seL4_IllegalOperation; seL4_AlignmentError \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q617 err' luf') (?S617 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 2. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 3. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 4. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 5. \<And>err' luf'. \<lbrakk>msg = [invalidArgumentNumber_C err']; err = Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err')); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidArgumentNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 6. \<And>err' luf' s s'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); (s, s') \<in> rf_sr; valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread \<and> receiveIPCBuffer_' s' = option_to_ptr buf \<and> (if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C (current_syscall_error_' (globals s'))) (rangeErrorMax_C (current_syscall_error_' (globals s')))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s')))) \<circ> lookup_fault_to_H) (lookup_fault_lift (current_lookup_fault_' (globals s'))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C (current_syscall_error_' (globals s')))) else None) = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None)\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> ?Q617 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc 0 + length (msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf')))) < 120 \<and> True)) s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> True) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>_. True)) s)))))))) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s' \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s' \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s' \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s' \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s' \<in> ?S617 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. if failedLookupWasSource_C (current_syscall_error_' (globals s)) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err')))\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread \<and> \<acute>receiveIPCBuffer = option_to_ptr buf \<and> (\<exists>z. lookup_fault_lift \<acute>current_lookup_fault = Some z \<and> lookup_fault_to_H z = lookup_fault_to_H (the (lookup_fault_lift luf')))\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. memoryLeft_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = memoryLeft_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>))))))) proof (prove)
goal (5 subgoals):
 1. \<And>err' luf'. \<lbrakk>msg = [rangeErrorMin_C err', rangeErrorMax_C err']; err = Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err'); seL4_RangeError \<noteq> seL4_InvalidArgument; seL4_RangeError \<noteq> seL4_InvalidCapability; seL4_RangeError \<noteq> seL4_IllegalOperation; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q614 err' luf') (?S614 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (rangeErrorMin_C err');
y <- setMR thread buf (Suc 0) (rangeErrorMax_C err');
return (word_of_nat y)
od) (CALL setMR_'proc(\<acute>thread,0,rangeErrorMin_C \<acute>current_syscall_error);;
\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,1,rangeErrorMax_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 2. \<And>err' luf'. \<lbrakk>msg = []; err = Fault_H.syscall_error.IllegalOperation; seL4_IllegalOperation \<noteq> seL4_InvalidArgument; seL4_IllegalOperation \<noteq> seL4_InvalidCapability; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q611 err' luf') (?S611 err' luf') (SKIP # hs) (return 0) (return_C ret__unsigned_long_'_update (\<lambda>s. 0))
 3. \<And>err' luf'. \<lbrakk>msg = [invalidCapNumber_C err']; err = Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err')); seL4_InvalidCapability \<noteq> seL4_InvalidArgument; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q608 err' luf') (?S608 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidCapNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidCapNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 4. \<And>err' luf'. \<lbrakk>msg = [invalidArgumentNumber_C err']; err = Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err')); type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q605 err' luf') (?S605 err' luf') (SKIP # hs) (do y <- setMR thread buf 0 (invalidArgumentNumber_C err');
return (word_of_nat y)
od) (\<acute>ret__unsigned :== CALL setMR_'proc(\<acute>thread,0,invalidArgumentNumber_C \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update ret__unsigned_')
 5. \<And>err' luf' s s'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); (s, s') \<in> rf_sr; valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread \<and> receiveIPCBuffer_' s' = option_to_ptr buf \<and> (if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C (current_syscall_error_' (globals s'))) (rangeErrorMax_C (current_syscall_error_' (globals s')))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s')))) \<circ> lookup_fault_to_H) (lookup_fault_lift (current_lookup_fault_' (globals s'))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C (current_syscall_error_' (globals s')))) else None) = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None)\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> ?Q605 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> ?Q608 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> ?Q611 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> ?Q614 err' luf' s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> True) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc 0 + length (msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf')))) < 120 \<and> True)) s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> True) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>_. True)) s)))))))) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s' \<in> ?S605 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s' \<in> ?S608 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s' \<in> ?S611 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s' \<in> ?S614 err' luf') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. if failedLookupWasSource_C (current_syscall_error_' (globals s)) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err')))\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread \<and> \<acute>receiveIPCBuffer = option_to_ptr buf \<and> (\<exists>z. lookup_fault_lift \<acute>current_lookup_fault = Some z \<and> lookup_fault_to_H z = lookup_fault_to_H (the (lookup_fault_lift luf')))\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. memoryLeft_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = memoryLeft_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>))))))) proof (prove)
goal (1 subgoal):
 1. \<And>err' luf' s s'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); (s, s') \<in> rf_sr; valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread \<and> receiveIPCBuffer_' s' = option_to_ptr buf \<and> (if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C (current_syscall_error_' (globals s'))) (rangeErrorMax_C (current_syscall_error_' (globals s')))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s')))) \<circ> lookup_fault_to_H) (lookup_fault_lift (current_lookup_fault_' (globals s'))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C (current_syscall_error_' (globals s')))) else None) = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None)\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>_. True)) s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>_. True)) s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> True) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc 0 < msgMaxLength \<and> True)) s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> True) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc 0 + length (msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf')))) < 120 \<and> True)) s) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> True) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> True) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. 0 < msgMaxLength) and (\<lambda>_. True)) s)))))))) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. invalidArgumentNumber_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = invalidArgumentNumber_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. invalidCapNumber_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = invalidCapNumber_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. rangeErrorMin_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = rangeErrorMin_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>rangeErrorMax_C \<acute>current_syscall_error = rangeErrorMax_C err' \<and> \<acute>thread = tcb_ptr_to_ctcb_ptr thread \<and> \<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. if failedLookupWasSource_C (current_syscall_error_' (globals s)) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err')))\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread \<and> \<acute>receiveIPCBuffer = option_to_ptr buf \<and> (\<exists>z. lookup_fault_lift \<acute>current_lookup_fault = Some z \<and> lookup_fault_to_H z = lookup_fault_to_H (the (lookup_fault_lift luf')))\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> s' \<in> \<lbrace>0 = 0 && mask msgLengthBits\<rbrace>) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> s' \<in> {s. reg_'_update (\<lambda>_. memoryLeft_C (current_syscall_error_' (globals s))) (offset_'_update (\<lambda>_. 0) (receiver_'_update (\<lambda>_. thread_' s) s)) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat 0\<rbrace> \<inter> \<lbrace>\<acute>reg = memoryLeft_C err'\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>))))))) proof (prove)
goal (1 subgoal):
 1. \<And>err' luf' s s'. \<lbrakk>msg = snd (case err of Fault_H.syscall_error.IllegalOperation \<Rightarrow> (3, []) | Fault_H.syscall_error.InvalidArgument n \<Rightarrow> (1, [fromIntegral n]) | Fault_H.syscall_error.TruncatedMessage \<Rightarrow> (7, []) | Fault_H.syscall_error.DeleteFirst \<Rightarrow> (8, []) | Fault_H.syscall_error.RangeError minV maxV \<Rightarrow> (4, [minV, maxV]) | Fault_H.syscall_error.FailedLookup s lf \<Rightarrow> (6, (fromIntegral $ fromEnum s) # msgFromLookupFailure lf) | Fault_H.syscall_error.InvalidCapability n \<Rightarrow> (2, [fromIntegral n]) | Fault_H.syscall_error.RevokeFirst \<Rightarrow> (9, []) | Fault_H.syscall_error.NotEnoughMemory n \<Rightarrow> (0xA, [n]) | Fault_H.syscall_error.AlignmentError \<Rightarrow> (5, [])); Some err = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None); (s, s') \<in> rf_sr; valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread \<and> receiveIPCBuffer_' s' = option_to_ptr buf \<and> (if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C (current_syscall_error_' (globals s'))))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C (current_syscall_error_' (globals s'))) (rangeErrorMax_C (current_syscall_error_' (globals s')))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s')))) \<circ> lookup_fault_to_H) (lookup_fault_lift (current_lookup_fault_' (globals s'))) else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C (current_syscall_error_' (globals s')))) else None) = (if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument then Some (Fault_H.syscall_error.InvalidArgument (unat (invalidArgumentNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability then Some (Fault_H.syscall_error.InvalidCapability (unat (invalidCapNumber_C err'))) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation then Some Fault_H.syscall_error.IllegalOperation else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError then Some (Fault_H.syscall_error.RangeError (rangeErrorMin_C err') (rangeErrorMax_C err')) else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError then Some Fault_H.syscall_error.AlignmentError else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup then map_option (Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) \<circ> lookup_fault_to_H) (lookup_fault_lift luf') else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage then Some Fault_H.syscall_error.TruncatedMessage else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst then Some Fault_H.syscall_error.DeleteFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst then Some Fault_H.syscall_error.RevokeFirst else if type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory then Some (Fault_H.syscall_error.NotEnoughMemory (memoryLeft_C err')) else None)\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> length (msgFromLookupFailure (lookup_fault_to_H (the (lookup_fault_lift luf')))) < 119) \<and> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> invalidArgumentNumber_C (current_syscall_error_' (globals s')) = invalidArgumentNumber_C err') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidArgument \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> invalidCapNumber_C (current_syscall_error_' (globals s')) = invalidCapNumber_C err') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability \<longrightarrow> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> rangeErrorMin_C (current_syscall_error_' (globals s')) = rangeErrorMin_C err' \<and> rangeErrorMax_C (current_syscall_error_' (globals s')) = rangeErrorMax_C err') \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RangeError \<longrightarrow> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError \<longrightarrow> (type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> (if failedLookupWasSource_C (current_syscall_error_' (globals s')) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) \<and> (\<exists>z. lookup_fault_lift (current_lookup_fault_' (globals s')) = Some z \<and> lookup_fault_to_H z = lookup_fault_to_H (the (lookup_fault_lift luf')))) \<and> (type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup \<longrightarrow> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst \<and> type_C err' \<noteq> SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage \<longrightarrow> type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_NotEnoughMemory \<longrightarrow> memoryLeft_C (current_syscall_error_' (globals s')) = memoryLeft_C err')))) proof (prove)
goal (1 subgoal):
 1. \<And>err' luf' s s' z za. \<lbrakk>seL4_FailedLookup \<noteq> seL4_IllegalOperation; seL4_FailedLookup \<noteq> seL4_AlignmentError; (s, s') \<in> rf_sr; msg = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) # msgFromLookupFailure (lookup_fault_to_H z); seL4_FailedLookup \<noteq> seL4_InvalidArgument; valid_pspace' s; (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; thread_' s' = tcb_ptr_to_ctcb_ptr thread; receiveIPCBuffer_' s' = option_to_ptr buf; seL4_FailedLookup \<noteq> seL4_InvalidCapability; seL4_FailedLookup \<noteq> seL4_RangeError; type_C err' = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; lookup_fault_lift luf' = Some z; type_C (current_syscall_error_' (globals s')) = SCAST(32 signed \<rightarrow> 32) seL4_FailedLookup; err = Fault_H.syscall_error.FailedLookup (to_bool (failedLookupWasSource_C err')) (lookup_fault_to_H z); lookup_fault_lift (current_lookup_fault_' (globals s')) = Some za; to_bool (failedLookupWasSource_C (current_syscall_error_' (globals s'))) = to_bool (failedLookupWasSource_C err'); lookup_fault_to_H za = lookup_fault_to_H z\<rbrakk> \<Longrightarrow> (tcb_at' thread s \<longrightarrow> length (msgFromLookupFailure (lookup_fault_to_H z)) < 119) \<and> (if failedLookupWasSource_C (current_syscall_error_' (globals s')) \<noteq> 0 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0) = word_of_nat (fromEnum (to_bool (failedLookupWasSource_C err'))) proof (prove)
goal:
No subgoals!